jekyll-client-search 0.3.0 → 0.3.2

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: ed1c7a635cc419d9fb130411ced8e64a473c016e8188e36ddd98ea6922a098f7
-  data.tar.gz: f320844ded59274df991b1aa3d56fb22560e818105c5a0e682ea6e6a0c67df88
+  metadata.gz: d8289b785b9591674a7c171eea4ac3a3500765d79dd6679793a5c693879d7ed1
+  data.tar.gz: 2cc203750200af25356f75ca4e272747f39763f7abcfd9bedc9eff2ee9332b24
 SHA512:
-  metadata.gz: a12fb0052f9a727baf957735cd23fc9759f46fe7b54977acd16ed63edb14b0d63e2594d3c2bee936c9317541f8810a654acf7a5369746c9d11c39699457cf351
-  data.tar.gz: 46986b4c1a0107821f6932d8538c1aff0fcc386ddb9e9f787a4890da5f8af3ccd30a8c0b6b9257d928d3b52aa6fe625806136812cfbf781763a0f3a391cf9aa6
+  metadata.gz: 9ffd9295cb6e23c001c8c88acbdeb5fa8252a47dd646c58ef5f09b4a0233fe88b026cea4c5f8a4b0cc9b03e2907377e6b070af3066c2b266752ad1e49163beaf
+  data.tar.gz: 90261e2e563cf3649913211bcded60669fe55abec5a9e5caf1fa049e4342874d4a33e2ff058b72c35817ed96fed92b88a10c94731c2f7c7467940413f4444211

data/CHANGELOG.md

@@ -2,6 +2,38 @@
 
 ## Unreleased
 
+## 0.3.2 — 2026-09-10
+
+### Added
+- Semgrep security scan in CI (`semgrep ci` job in `.github/workflows/ci.yml`) — runs on every push and pull request using the `SEMGREP_APP_TOKEN` secret and the Semgrep Pro engine with the organization's full policy (2,900+ rules)
+- `.semgrep.yml` with custom Ruby ReDoS detection rules and usage documentation
+- Semgrep step in pre-commit hook (`bin/install-hooks.sh`)
+- Dependabot configuration for GitHub Actions (`.github/dependabot.yml`) — weekly SHA-pinned action updates
+- CodeFactor and Semgrep badges in README.md
+- Documentation of CodeQL, Semgrep, CodeFactor, and Dependabot in README.md, README.developer.md, and AGENTS.md
+- Semgrep usage guide in README.developer.md (local commands, nosemgrep annotations, SHA pinning)
+
+### Fixed
+- Pin all GitHub Actions to full 40-character commit SHAs with version comments to prevent supply-chain attacks via mutable tag repointing (Semgrep: `github-actions-mutable-action-tag`)
+- Replace `Object.assign({}, entry, ...)` in benchmark with explicit field construction to avoid mass-assignment taint (Semgrep: `insecure-object-assign`)
+- Replace manual arXiv query string with `URI.encode_www_form` for correct URL encoding (Semgrep: `avoid-tainted-http-request`)
+
+### Changed
+- Add `nosemgrep` annotations with justifications for false positives (static ERB template, array-form `Open3.capture2`, fixed-host arXiv request) and acceptable risks (local loopback Ollama HTTP in tests and benchmarks)
+
+## 0.3.1 — 2026-09-09
+
+### Fixed
+- Fix CodeQL `rb/bad-tag-filter` (high) in `DocumentBuilder#clean` — closing tag regex `</script\s*>` only matched whitespace before `>`, missing browser-accepted tags like `</script\t\n bar>`; changed to `</script[^>]*>` and `</style[^>]*>` to match any non-`>` content
+- Fix CodeQL `rb/polynomial-redos` (high) in `RelatedTag` — `\s*` patterns between optional groups in SYNTAX regex caused O(n²) backtracking on input with many spaces; replaced single regex with token-split parser that validates each token individually
+
+### Changed
+- Update `simplecov` 1.1.1 → 1.2.0
+- Update `google-protobuf` 4.36.0 → 4.36.1 (transitive)
+- Update `sass-embedded` 1.103.1 → 1.104.0 (transitive)
+- Update `eslint` 10.9.1 → 10.10.0 (dev)
+- Update `globals` 17.11.0 → 17.12.0 (dev)
+
 ## 0.3.0 — 2026-09-02
 
 ### Added

data/README.developer.md

@@ -24,9 +24,50 @@ are required for the default test run.
 ## Quality checks and git hooks
 
 The project uses a focused quality stack: RuboCop (style), bundler-audit
-(security), RSpec (Ruby tests), and `npm test` (JavaScript tests). This
-covers the actionable ground without the maintenance burden of additional
-code-smell tools on a small focused gem.
+(security), RSpec (Ruby tests), `npm test` (JavaScript tests), and Semgrep
+(security scanning). This covers the actionable ground without the
+maintenance burden of additional code-smell tools on a small focused gem.
+
+External automated code review services:
+- [CodeQL](https://codeql.github.com) — GitHub native security scanning
+  (Ruby + JavaScript), runs on every push.
+- [Semgrep](https://semgrep.dev) — CI security scan using the Semgrep Pro
+  engine with the organization's full policy (2,900+ rules). Runs as a CI
+  job (`semgrep ci`) and in the pre-commit hook (custom rules only). See
+  `.semgrep.yml` for local configuration and usage instructions.
+- [CodeFactor](https://www.codefactor.io/repository/github/gundestrup/jekyll-client-search) —
+  automated code review (RuboCop, Brakeman, bundler-audit, duplication).
+- [Dependabot](https://docs.github.com/en/code-security/dependabot) — weekly
+  GitHub Actions version updates (SHA-pinned actions updated automatically).
+
+### Semgrep usage
+
+The project uses two Semgrep scanning modes:
+
+1. **Pre-commit hook** — runs `semgrep scan --config .semgrep.yml` with only
+   the custom ReDoS rules defined in `.semgrep.yml`. Fast (~3s).
+2. **CI job** — runs `semgrep ci` with the full organization policy from the
+   Semgrep AppSec Platform, including Pro engine rules. Findings are uploaded
+   to the dashboard for triage.
+
+Local commands:
+
+```bash
+semgrep scan --config .semgrep.yml --error lib/ assets/   # custom rules only
+semgrep ci --dry-run                                        # full org policy, no upload
+semgrep ci                                                   # full org policy, upload to dashboard
+```
+
+To suppress a false positive or acceptable risk, add an inline annotation
+with the full rule ID and a justification:
+
+```ruby
+# nosemgrep: problem-based-packs.insecure-transport.ruby-stdlib.net-http-request.net-http-request
+# Acceptable risk: local loopback Ollama test endpoint.
+```
+
+All GitHub Actions are pinned to full 40-character commit SHAs with version
+comments. Dependabot updates the SHAs and version comments automatically.
 
 ### Rake tasks
 
@@ -55,12 +96,12 @@ This installs two hooks:
 
 | Hook | What it runs | When |
 | --- | --- | --- |
-| `pre-commit` | `rubocop` only (~2s) | Before each commit |
+| `pre-commit` | `rubocop + semgrep` (~5s) | Before each commit |
 | `pre-push` | `rubocop + rspec` (~15s) | Before each push |
 
-The pre-commit hook is intentionally fast (style only) to avoid bypassing
-with `--no-verify`. The full test suite runs on pre-push and in CI. Skip
-either with `git commit --no-verify` or `git push --no-verify`.
+The pre-commit hook is intentionally fast (style + security) to avoid
+bypassing with `--no-verify`. The full test suite runs on pre-push and in
+CI. Skip either with `git commit --no-verify` or `git push --no-verify`.
 
 ### CI checks
 
@@ -71,6 +112,7 @@ request across Ruby 3.2/3.3/3.4 and Node 22/24:
 - `bundle exec bundle-audit check --update` (Ruby dependency security)
 - `npm audit --audit-level=high` (JavaScript dependency security)
 - `npm outdated` (non-blocking — warns about outdated npm packages)
+- `semgrep ci` (security scan with custom rules from `.semgrep.yml`)
 
 ## Build-time related articles
 

data/README.md

@@ -8,6 +8,8 @@
 [![License: AGPL v3](https://img.shields.io/badge/license-AGPL--3.0--or--later-blue.svg)](LICENSE)
 [![DeepWiki](https://img.shields.io/badge/DeepWiki-docs-7B68EE.svg)](https://deepwiki.com/gundestrup/jekyll-client-search)
 [![Coverage](https://img.shields.io/badge/coverage-100%25%20branches-brightgreen.svg)](#testing-strategy)
+[![Semgrep](https://img.shields.io/badge/semgrep-scanning-brightgreen.svg)](https://semgrep.dev)
+[![CodeFactor](https://www.codefactor.io/repository/github/gundestrup/jekyll-client-search/badge)](https://www.codefactor.io/repository/github/gundestrup/jekyll-client-search)
 
 A Jekyll plugin that generates a JSON document index for client-side search.
 Supports lexical search ([MiniSearch](https://lucaong.github.io/minisearch/),
@@ -1140,10 +1142,30 @@ bundle exec rake ci
 
 GitHub Actions are configured in `.github/workflows/`:
 
-- `ci.yml` runs the test and gem build checks on pushes and pull requests.
+- `ci.yml` runs the test and gem build checks on pushes and pull requests,
+  plus a Semgrep security scan job.
 - `release.yml` runs on `v*` tags or manual dispatch, verifies the gem, and
   publishes it using RubyGems trusted publishing.
 
+Additional automated code quality and security services:
+
+- [CodeQL](https://codeql.github.com) — GitHub native code scanning for
+  security vulnerabilities (Ruby + JavaScript).
+- [Semgrep](https://semgrep.dev) — CI security scan using the Semgrep Pro
+  engine with the organization's full policy (2,900+ rules). Custom ReDoS
+  detection rules are defined in `.semgrep.yml`. Findings are triaged on the
+  [Semgrep AppSec Platform](https://semgrep.dev) dashboard. False positives
+  and acceptable risks are annotated inline with `# nosemgrep: rule.id`.
+- [CodeFactor](https://www.codefactor.io/repository/github/gundestrup/jekyll-client-search) —
+  automated code review with RuboCop, Brakeman, bundler-audit, and duplication
+  checks.
+- [Dependabot](https://docs.github.com/en/code-security/dependabot) — weekly
+  checks for GitHub Actions version updates (SHA-pinned actions are kept
+  up to date automatically).
+
+All GitHub Actions are pinned to full 40-character commit SHAs with version
+comments to prevent supply-chain attacks via mutable tag repointing.
+
 Before enabling releases:
 
 1. Configure the GitHub repository as a RubyGems trusted publisher.

data/lib/jekyll/client_search/document_builder.rb

@@ -67,8 +67,8 @@ module Jekyll
 
       def clean(value)
         cleaned = value.to_s
-                       .gsub(%r{<script\b[^>]*>.*?</script\s*>}mi, " ")
-                       .gsub(%r{<style\b[^>]*>.*?</style\s*>}mi, " ")
+                       .gsub(%r{<script\b[^>]*>.*?</script[^>]*>}mi, " ")
+                       .gsub(%r{<style\b[^>]*>.*?</style[^>]*>}mi, " ")
                        .gsub(/\{%.*?%\}/m, " ")
                        .gsub(/\{\{.*?\}\}/m, " ")
                        .gsub(/!\[[^\]]*\]\([^)]*\)/, " ")

data/lib/jekyll/client_search/related_tag.rb

@@ -14,23 +14,39 @@ module Jekyll
     # When +related.enabled+ is false the tag renders nothing, so it is safe
     # to leave in a layout even when the feature is off.
     class RelatedTag < Liquid::Tag
-      SYNTAX = /\A(sort:(\w+))?\s*(max:(\d+))?\s*(no_scripts)?\z/
+      TOKEN_SYNTAX = /\A(sort:\w+|max:\d+|no_scripts)\z/
 
       def initialize(tag_name, markup, tokens)
         super
         @markup = markup.to_s.strip
-        unless (match = @markup.match(SYNTAX))
-          raise Liquid::SyntaxError,
-                "related_articles: invalid syntax. Use {% related_articles %}, " \
-                "{% related_articles sort:date %}, {% related_articles max:3 %}, " \
-                "or {% related_articles no_scripts %}"
-        end
+        parse_tokens(@markup)
+      end
+
+      def parse_tokens(markup)
+        @sort = nil
+        @max_items = nil
+        @include_scripts = true
+        return if markup.empty?
+
+        markup.split(/\s+/).each { |token| apply_token(token) }
+      end
+
+      def apply_token(token)
+        raise Liquid::SyntaxError, syntax_error_msg unless token.match(TOKEN_SYNTAX)
 
-        @sort = match[2] if match[2]
-        @max_items = match[4].to_i if match[4]
-        raise Liquid::SyntaxError, "related_articles: max must be greater than zero" if @max_items && @max_items < 1
+        case token
+        when /\Asort:(\w+)\z/ then @sort = Regexp.last_match(1)
+        when /\Amax:(\d+)\z/
+          @max_items = Regexp.last_match(1).to_i
+          raise Liquid::SyntaxError, "related_articles: max must be greater than zero" if @max_items < 1
+        when "no_scripts" then @include_scripts = false
+        end
+      end
 
-        @include_scripts = match[5].nil?
+      def syntax_error_msg
+        "related_articles: invalid syntax. Use {% related_articles %}, " \
+          "{% related_articles sort:date %}, {% related_articles max:3 %}, " \
+          "or {% related_articles no_scripts %}"
       end
 
       def render(context)

data/lib/jekyll/client_search/version.rb

@@ -2,6 +2,6 @@
 
 module Jekyll
   module ClientSearch
-    VERSION = "0.3.0"
+    VERSION = "0.3.2"
   end
 end

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: jekyll-client-search
 version: !ruby/object:Gem::Version
-  version: 0.3.0
+  version: 0.3.2
 platform: ruby
 authors:
 - Svend Gundestrup