security: fix CodeQL + add workflow

Author: mowens3

.github/workflows/codeql.yml

@@ -0,0 +1,33 @@
+name: CodeQL
+
+on:
+  push:
+    branches: ["master"]
+  pull_request:
+    branches: ["master"]
+  schedule:
+    - cron: "0 3 * * 0"
+
+jobs:
+  analyze:
+    name: Analyze
+    runs-on: ubuntu-latest
+    permissions:
+      actions: read
+      contents: read
+      security-events: write
+    strategy:
+      fail-fast: false
+      matrix:
+        language: ["javascript-typescript"]
+
+    steps:
+      - uses: actions/checkout@v4
+
+      - name: Initialize CodeQL
+        uses: github/codeql-action/init@v3
+        with:
+          languages: ${{ matrix.language }}
+
+      - name: Perform CodeQL Analysis
+        uses: github/codeql-action/analyze@v3

src/media.ts

@@ -233,17 +233,54 @@ function getVideoEmbedUrl(url: string): string | undefined {
 }
 
 export function parseDrupalMediaTag(html: string): string | null {
-  const match = html.match(/data-entity-uuid=[\"']([^\"']+)[\"']/)
-  return match ? match[1] : null
+  const attr = "data-entity-uuid="
+  const start = html.indexOf(attr)
+  if (start === -1) {
+    return null
+  }
+
+  let index = start + attr.length
+  while (index < html.length && /\s/.test(html[index])) {
+    index += 1
+  }
+
+  const quote = html[index]
+  if (quote !== "\"" && quote !== "'") {
+    return null
+  }
+
+  const end = html.indexOf(quote, index + 1)
+  if (end === -1) {
+    return null
+  }
+
+  const uuid = html.slice(index + 1, end)
+  return uuid || null
 }
 
 export function extractEmbeddedMediaUuids(html: string): string[] {
-  const regex = /<drupal-media[^>]*data-entity-uuid=[\"']([^\"']+)[\"'][^>]*>/g
   const uuids: string[] = []
-  let match
+  const tagStart = "<drupal-media"
+  let index = 0
+
+  while (index < html.length) {
+    const start = html.indexOf(tagStart, index)
+    if (start === -1) {
+      break
+    }
+
+    const end = html.indexOf(">", start)
+    if (end === -1) {
+      break
+    }
+
+    const tag = html.slice(start, end + 1)
+    const uuid = parseDrupalMediaTag(tag)
+    if (uuid) {
+      uuids.push(uuid)
+    }
 
-  while ((match = regex.exec(html)) !== null) {
-    uuids.push(match[1])
+    index = end + 1
   }
 
   return uuids

src/url.ts

@@ -67,9 +67,11 @@ export function getImageStyleUrl(originalUrl: string, style: string, options?: {
     return resolved.replace(/\/styles\/[^/]+\//, `/styles/${style}/`)
   }
 
-  const filesMatch = resolved.match(/(.+\/files\/)(.+)$/)
-  if (filesMatch) {
-    const [, basePath, filePath] = filesMatch
+  const marker = "/files/"
+  const markerIndex = resolved.indexOf(marker)
+  if (markerIndex !== -1) {
+    const basePath = resolved.slice(0, markerIndex + marker.length)
+    const filePath = resolved.slice(markerIndex + marker.length)
     return `${basePath}styles/${style}/public/${filePath}`
   }