jekyll-client-search 0.3.2 → 0.3.4

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: d8289b785b9591674a7c171eea4ac3a3500765d79dd6679793a5c693879d7ed1
-  data.tar.gz: 2cc203750200af25356f75ca4e272747f39763f7abcfd9bedc9eff2ee9332b24
+  metadata.gz: 74262c7813a4c946b9a4c9c7d7a19aa1d866dedfdf82781131e5edbe9aabbdef
+  data.tar.gz: 6ebbd6018cfc419d586d50d60d7d346c5a6c0a7b442275caf55fc22d3420a797
 SHA512:
-  metadata.gz: 9ffd9295cb6e23c001c8c88acbdeb5fa8252a47dd646c58ef5f09b4a0233fe88b026cea4c5f8a4b0cc9b03e2907377e6b070af3066c2b266752ad1e49163beaf
-  data.tar.gz: 90261e2e563cf3649913211bcded60669fe55abec5a9e5caf1fa049e4342874d4a33e2ff058b72c35817ed96fed92b88a10c94731c2f7c7467940413f4444211
+  metadata.gz: 402221144b4bbf95e1daf759430c6a59fad8025d650f4f84624146ed44951de2e34755a1e335f478aeabe2fbec693f2b95c74c64aad1ff19e54b3a1e30213ee8
+  data.tar.gz: 84d405d332fdd45895885b43dc408a46574b97f26f2b1742513ad97f9910e0ed96f6bb4ddff0c4cf0148751b2a0348b97b5adaa41aab57ba5c724c07f0827d5e

data/CHANGELOG.md

@@ -2,6 +2,24 @@
 
 ## Unreleased
 
+## 0.3.4 — 2026-09-11
+
+### Added
+- SonarQube Cloud badge in README.md (project key: `gundestrup_jekyll-client-search`)
+
+### Fixed
+- Verify `event.origin` in transformers-worker.js `message` listener to prevent cross-origin message injection (SonarQube: `javascript:S2819`, CRITICAL)
+- Add `--ignore-scripts` to `npm ci` in CI to prevent lifecycle script execution during dependency installation (SonarQube: `githubactions:S6505`)
+- Pin Semgrep to `1.176.0` with `--only-binary :all:` in CI to prevent setup script execution and lock resolved versions (SonarQube: `githubactions:S8541`, `githubactions:S8544`)
+- Wrap `normalize` and `resultElement` callbacks in anonymous functions in `.map()` calls to avoid passing unexpected iterator arguments (SonarQube: `javascript:S7727`)
+- Wrap `search` callback in anonymous function in `.forEach()` call in benchmark (SonarQube: `javascript:S7727`)
+- Replace `parseInt` with `Number.parseInt` in dropdown and related runtimes (SonarQube: `javascript:S7773`)
+
+## 0.3.3 — 2026-09-11
+
+### Refactored
+- Extract duplicated `normalize` function from `client-search-base.js` and `client-search-dropdown.js` into new shared module `assets/client-search-shared.js` (exposes `window.ClientSearchShared.normalize` and `window.ClientSearchShared.coreFields`) — eliminates CodeFactor duplicate-code finding and ensures consistent normalization across both runtimes
+
 ## 0.3.2 — 2026-09-10
 
 ### Added

data/README.md

@@ -10,6 +10,7 @@
 [![Coverage](https://img.shields.io/badge/coverage-100%25%20branches-brightgreen.svg)](#testing-strategy)
 [![Semgrep](https://img.shields.io/badge/semgrep-scanning-brightgreen.svg)](https://semgrep.dev)
 [![CodeFactor](https://www.codefactor.io/repository/github/gundestrup/jekyll-client-search/badge)](https://www.codefactor.io/repository/github/gundestrup/jekyll-client-search)
+[![SonarQube](https://sonarcloud.io/api/project_badges/measure?project=gundestrup_jekyll-client-search&metric=alert_status)](https://sonarcloud.io/project/overview?id=gundestrup_jekyll-client-search)
 
 A Jekyll plugin that generates a JSON document index for client-side search.
 Supports lexical search ([MiniSearch](https://lucaong.github.io/minisearch/),

data/assets/client-search-base.js

@@ -58,55 +58,15 @@
                 return;
             }
 
-            var coreFields = [
-                "id", "title", "url", "excerpt", "content",
-                "categories", "tags", "categoriesText", "tagsText",
-                "date", "date_timestamp", "embedding"
-            ];
-
-            function normalize(entry) {
-                var id = entry.id || entry.url;
-                if (!id) {
-                    return null;
-                }
-                var categories = Array.isArray(entry.categories) ? entry.categories : [];
-                var tags = Array.isArray(entry.tags) ? entry.tags : [];
-                var normalized = {
-                    id: id,
-                    title: entry.title || "Untitled",
-                    url: entry.url || "#",
-                    excerpt: entry.excerpt || "",
-                    content: entry.content || "",
-                    date: entry.date || "",
-                    date_timestamp: Number(entry.date_timestamp) || 0,
-                    categories: categories,
-                    tags: tags,
-                    categoriesText: categories.join(" "),
-                    tagsText: tags.join(" ")
-                };
-                if (entry.source) {
-                    normalized.source = entry.source;
-                }
-                if (Array.isArray(entry.embedding) && entry.embedding.length > 0) {
-                    normalized.embedding = entry.embedding;
-                }
-                Object.keys(entry).forEach(function (key) {
-                    if (coreFields.indexOf(key) === -1 && key !== "source" && !(key in normalized)) {
-                        var value = entry[key];
-                        if (value !== null && value !== undefined && value !== "") {
-                            normalized[key] = value;
-                        }
-                    }
-                });
-                return normalized;
-            }
+            var normalize = window.ClientSearchShared.normalize;
+            var coreFields = window.ClientSearchShared.coreFields;
 
             function buildIndex(data) {
                 if (!Array.isArray(data)) {
                     throw new TypeError("Search index must be an array");
                 }
 
-                var documents = data.map(normalize).filter(Boolean);
+                var documents = data.map(function (entry) { return normalize(entry); }).filter(Boolean);
                 documentsById = new Map(documents.map(function (entry) {
                     return [entry.id, entry];
                 }));
@@ -272,7 +232,7 @@
                 }
                 results.replaceChildren.apply(
                     results,
-                    matches.map(resultElement).filter(Boolean)
+                    matches.map(function (match) { return resultElement(match); }).filter(Boolean)
                 );
             }
 

data/assets/client-search-dropdown.js

@@ -41,39 +41,7 @@
         return key.replace(/_([a-z])/g, function (_, char) { return char.toUpperCase(); });
     }
 
-    function normalize(entry) {
-        var id = entry.id || entry.url;
-        if (!id) {
-            return null;
-        }
-        var categories = Array.isArray(entry.categories) ? entry.categories : [];
-        var tags = Array.isArray(entry.tags) ? entry.tags : [];
-        var normalized = {
-            id: id,
-            title: entry.title || "Untitled",
-            url: entry.url || "#",
-            excerpt: entry.excerpt || "",
-            content: entry.content || "",
-            date: entry.date || "",
-            date_timestamp: Number(entry.date_timestamp) || 0,
-            categories: categories,
-            tags: tags,
-            categoriesText: categories.join(" "),
-            tagsText: tags.join(" ")
-        };
-        if (entry.source) {
-            normalized.source = entry.source;
-        }
-        Object.keys(entry).forEach(function (key) {
-            if (!(key in normalized) && key !== "embedding") {
-                var value = entry[key];
-                if (value !== null && value !== undefined && value !== "") {
-                    normalized[key] = value;
-                }
-            }
-        });
-        return normalized;
-    }
+    var normalize = window.ClientSearchShared.normalize;
 
     function loadIndex(config) {
         if (sharedIndex && sharedDocuments) {
@@ -99,7 +67,7 @@
                 if (!Array.isArray(data)) {
                     throw new TypeError("Search index must be an array");
                 }
-                var documents = data.map(normalize).filter(Boolean);
+                var documents = data.map(function (entry) { return normalize(entry); }).filter(Boolean);
                 var adapter = window.ClientSearchAdapters &&
                     (window.ClientSearchAdapters[config.engine] ||
                      window.ClientSearchAdapters.minisearch);
@@ -209,7 +177,7 @@
         this.input = root.querySelector("[data-cs-dropdown-input]");
         this.results = root.querySelector("[data-cs-dropdown-results]");
         this.config = config;
-        this.maxItems = parseInt(this.results.dataset.maxItems, 10) || config.maxItems || 5;
+        this.maxItems = Number.parseInt(this.results.dataset.maxItems, 10) || config.maxItems || 5;
         this.selectedIndex = -1;
         this.currentItems = [];
         this.debounceTimer = null;

data/assets/client-search-related.js

@@ -153,7 +153,7 @@
             }
 
             if (container.dataset.relatedMax) {
-                options.maxItems = parseInt(container.dataset.relatedMax, 10) || 0;
+                options.maxItems = Number.parseInt(container.dataset.relatedMax, 10) || 0;
             }
 
             return fetch(options.relationsUrl, { headers: { Accept: "application/json" } })

data/assets/client-search-shared.js

@@ -0,0 +1,57 @@
+(function () {
+    "use strict";
+
+    /**
+     * ClientSearch shared utilities — used by the base runtime and the
+     * dropdown runtime to normalize search index entries into a uniform
+     * document format.
+     *
+     * Loaded before client-search-base.js and client-search-dropdown.js.
+     * Exposes window.ClientSearchShared.normalize(entry).
+     */
+
+    var CORE_FIELDS = [
+        "id", "title", "url", "excerpt", "content",
+        "categories", "tags", "categoriesText", "tagsText",
+        "date", "date_timestamp", "embedding"
+    ];
+
+    function normalize(entry) {
+        var id = entry.id || entry.url;
+        if (!id) {
+            return null;
+        }
+        var categories = Array.isArray(entry.categories) ? entry.categories : [];
+        var tags = Array.isArray(entry.tags) ? entry.tags : [];
+        var normalized = {
+            id: id,
+            title: entry.title || "Untitled",
+            url: entry.url || "#",
+            excerpt: entry.excerpt || "",
+            content: entry.content || "",
+            date: entry.date || "",
+            date_timestamp: Number(entry.date_timestamp) || 0,
+            categories: categories,
+            tags: tags,
+            categoriesText: categories.join(" "),
+            tagsText: tags.join(" ")
+        };
+        if (entry.source) {
+            normalized.source = entry.source;
+        }
+        if (Array.isArray(entry.embedding) && entry.embedding.length > 0) {
+            normalized.embedding = entry.embedding;
+        }
+        Object.keys(entry).forEach(function (key) {
+            if (CORE_FIELDS.indexOf(key) === -1 && key !== "source" && !(key in normalized)) {
+                var value = entry[key];
+                if (value !== null && value !== undefined && value !== "") {
+                    normalized[key] = value;
+                }
+            }
+        });
+        return normalized;
+    }
+
+    window.ClientSearchShared = { normalize: normalize, coreFields: CORE_FIELDS };
+})();

data/assets/query-embedders/transformers-worker.js

@@ -106,6 +106,9 @@ async function embed(query) {
 }
 
 self.addEventListener("message", function (event) {
+    if (event.origin !== self.location.origin) {
+        return;
+    }
     var message = event.data || {};
     activeConfig = activeConfig || message.config || {};
     latestRequestId = message.id;

data/lib/jekyll/client_search/configuration.rb

@@ -105,7 +105,7 @@ module Jekyll
       end
 
       def runtime_assets
-        assets = ["assets/client-search-base.js", "assets/adapters/#{engine}.js"]
+        assets = ["assets/client-search-shared.js", "assets/client-search-base.js", "assets/adapters/#{engine}.js"]
         assets.concat(query_embedder_assets) if engine == "semantic" && embedding_enabled?
         assets << "assets/client-search-related.js" if related_enabled?
         assets << "assets/client-search-dropdown.js" if dropdown_enabled?

data/lib/jekyll/client_search/dropdown_tag.rb

@@ -90,24 +90,30 @@ module Jekyll
 
       def build_scripts(configuration, prefix)
         scripts = []
-        engine = configuration.engine_url
-        if engine
-          attrs = ["src=\"#{CGI.escapeHTML(engine)}\""]
-          if configuration.engine_crossorigin
-            crossorigin = CGI.escapeHTML(configuration.engine_crossorigin)
-            attrs << "crossorigin=\"#{crossorigin}\""
-          end
-          if configuration.engine_sri
-            integrity = CGI.escapeHTML(configuration.engine_sri)
-            attrs << "integrity=\"#{integrity}\""
-          end
-          scripts << "<script #{attrs.join(' ')}></script>"
-        end
+        engine = engine_script(configuration)
+        scripts << engine if engine
         scripts << "<script src=\"#{prefix}/assets/search-runtime-config.js\"></script>"
+        scripts << "<script src=\"#{prefix}/assets/client-search-shared.js\"></script>"
         scripts << "<script src=\"#{prefix}/assets/client-search-dropdown.js\"></script>"
         scripts << "<script src=\"#{prefix}/assets/adapters/#{configuration.engine}.js\"></script>"
         scripts.map { |script| "  #{script}" }.join("\n")
       end
+
+      def engine_script(configuration)
+        url = configuration.engine_url
+        return nil unless url
+
+        attrs = ["src=\"#{CGI.escapeHTML(url)}\""]
+        if configuration.engine_crossorigin
+          crossorigin = CGI.escapeHTML(configuration.engine_crossorigin)
+          attrs << "crossorigin=\"#{crossorigin}\""
+        end
+        if configuration.engine_sri
+          integrity = CGI.escapeHTML(configuration.engine_sri)
+          attrs << "integrity=\"#{integrity}\""
+        end
+        "<script #{attrs.join(' ')}></script>"
+      end
     end
   end
 end

data/lib/jekyll/client_search/search_tag.rb

@@ -69,6 +69,7 @@ module Jekyll
         scripts << engine if engine
         scripts << "<script src=\"#{prefix}/assets/search-runtime-config.js\"></script>"
         scripts.concat(embedder_scripts(configuration, prefix))
+        scripts << "<script src=\"#{prefix}/assets/client-search-shared.js\"></script>"
         scripts << "<script src=\"#{prefix}/assets/client-search-base.js\"></script>"
         scripts << "<script src=\"#{prefix}/assets/adapters/#{configuration.engine}.js\"></script>"
         scripts.map { |script| "  #{script}" }.join("\n")

data/lib/jekyll/client_search/version.rb

@@ -2,6 +2,6 @@
 
 module Jekyll
   module ClientSearch
-    VERSION = "0.3.2"
+    VERSION = "0.3.4"
   end
 end

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: jekyll-client-search
 version: !ruby/object:Gem::Version
-  version: 0.3.2
+  version: 0.3.4
 platform: ruby
 authors:
 - Svend Gundestrup
@@ -48,6 +48,7 @@ files:
 - assets/client-search-base.js
 - assets/client-search-dropdown.js
 - assets/client-search-related.js
+- assets/client-search-shared.js
 - assets/includes/related-articles.html
 - assets/layouts/post-with-related.html
 - assets/query-embedders/ollama-api.js