silx-kit / h5web

React components for data visualization and exploration
https://h5web.panosc.eu/
MIT License
183 stars 18 forks source link

Fix overly permissive regex #1514

Closed axelboc closed 11 months ago

axelboc commented 11 months ago

I've activated CodeQL analysis on the repo to try it out: https://github.com/silx-kit/h5web/settings/security_analysis

It detected an issue in a regex: https://github.com/silx-kit/h5web/security/code-scanning/1

axelboc commented 11 months ago

Hmm but if the regex doesn't match, we throw an error; and the error is more for cases where the format of the dtype string is invalid rather than unknown. When the format looks right but the dtype "letter" is not recognised, then we return an unknown type. So I'd rather be lenient on the letter that can be matched.

However, maybe I should reword the error message to "Invalid dtype" to avoid confusion.

axelboc commented 11 months ago

I should add that this relates to the testing of the providers that I'd like to put in place: I'm hoping it will help make this kind of dtype parsing a bit more exhaustive and therefore stricter.