mirror of
https://github.com/yusufipk/OpenFrame.git
synced 2026-09-11 17:46:06 +00:00
CodeQL flags the substring form (js/incomplete-url-substring-sanitization) because a host check on an unparsed url matches when the host appears anywhere in it. Nothing untrusted reaches this recorder, but a loose match could still record a delete aimed elsewhere as a Bunny delete and pass an assertion for the wrong reason.