Skip to content

Conversation

@HerrTopi
Copy link
Contributor

No description provided.


function bootstrap() {
execSync(path.resolve('scripts/clean.js'), opts)

Check warning

Code scanning / CodeQL

Shell command built from environment values

This shell command depends on an uncontrolled [absolute path](1).

Copilot Autofix

AI 9 days ago

The fix is to avoid executing arbitrary shell commands built from dynamic path values via execSync. Instead, launch Node directly on the target script using execFileSync, passing the script path as an argument — this prevents shell expansion issues, avoids interpretation of spaces and special shell characters, and aligns with best practices. Specifically:

  • On line 68, in the bootstrap function, replace execSync(path.resolve('scripts/clean.js'), opts) with execFileSync(process.execPath, [path.resolve('scripts/clean.js')], opts). This runs the script under the Node interpreter rather than launching the script itself as a shell command.

  • Import execFileSync from child_process.

  • Optionally remove unused imports if needed (keep other code unchanged).

All changes are limited to the shown code in scripts/bootstrap.js.

Suggested changeset 1
scripts/bootstrap.js

Autofix patch

Autofix patch
Run the following command in your local git repository to apply this patch
cat << 'EOF' | git apply
diff --git a/scripts/bootstrap.js b/scripts/bootstrap.js
--- a/scripts/bootstrap.js
+++ b/scripts/bootstrap.js
@@ -24,7 +24,7 @@
  * OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
  * SOFTWARE.
  */
-const { execSync, fork } = require('child_process')
+const { execSync, execFileSync, fork } = require('child_process')
 const path = require('path')
 
 const opts = { stdio: 'inherit' }
@@ -65,7 +65,7 @@
 }
 
 function bootstrap() {
-  execSync(path.resolve('scripts/clean.js'), opts)
+  execFileSync(process.execPath, [path.resolve('scripts/clean.js')], opts)
   buildProject()
 }
 
EOF
@@ -24,7 +24,7 @@
* OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
* SOFTWARE.
*/
const { execSync, fork } = require('child_process')
const { execSync, execFileSync, fork } = require('child_process')
const path = require('path')

const opts = { stdio: 'inherit' }
@@ -65,7 +65,7 @@
}

function bootstrap() {
execSync(path.resolve('scripts/clean.js'), opts)
execFileSync(process.execPath, [path.resolve('scripts/clean.js')], opts)
buildProject()
}

Copilot is powered by AI and may make mistakes. Always verify output.
@github-actions
Copy link

github-actions bot commented Nov 11, 2025

PR Preview Action v1.6.2

🚀 View preview at
https://instructure.design/pr-preview/pr-2238/

Built to branch gh-pages at 2025-11-19 13:05 UTC.
Preview will be ready when the GitHub Pages deployment is complete.

@HerrTopi HerrTopi changed the base branch from master to v12 November 18, 2025 16:28
@HerrTopi HerrTopi requested review from balzss and matyasf and removed request for matyasf November 19, 2025 12:40

const styles = useStyle({
generateStyle,
generateComponentTheme,
Copy link
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

You can delete this line (and generateComponentTheme.ts too)

Copy link
Collaborator

@matyasf matyasf left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

see my comments

Comment on lines -39 to -42
/**
* Render Spinner "as" another HTML element
*/
as?: AsElementType
Copy link
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Removing this is a breaking change, please put it into the upgrade guide

* Valid values are `0`, `none`, `auto`, `xxx-small`, `xx-small`, `x-small`,
* `small`, `medium`, `large`, `x-large`, `xx-large`. Apply these values via
* familiar CSS-like shorthand. For example: `margin="small auto large"`.
* Valid values are from themes. See theme.semantics.spacing. Apply these values via
Copy link
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

This is theme specific, right? theme.semantics.spacing is not guaranteed to be this path, I'd rephrase it to "See "See theme.sharedTokens.spacing

<Spinner renderTitle="Loading" size="small" margin="0 0 0 medium" />
<Spinner renderTitle="Loading" margin="0 0 0 medium" />
<Spinner renderTitle="Loading" size="large" margin="0 0 0 medium" />
<div style={{ display: 'flex', alignItems: 'center', gap: 'spacing.spaceMd' }}>
Copy link
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

You cant use spacing.spaceMd here

type StyleParams = {
size: SpinnerProps['size']
variant: SpinnerProps['variant']
themeOverride: SpinnerProps['themeOverride']
Copy link
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

afaik we dont need themeOverride here, its handled by useStyle?

<Spinner renderTitle="Loading" size="small" margin="0 0 0 medium" delay={2000} />
<Spinner renderTitle="Loading" margin="0 0 0 medium" delay={3000} />
<Spinner renderTitle="Loading" size="large" margin="0 0 0 medium" delay={4000} />
<div style={{ display: 'flex', alignItems: 'center', gap: 'spacing.spaceMd' }}>
Copy link
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

You cant use this gap value here

Comment on lines 76 to 112
const spinnerSizes = {
'x-small': {
width: componentTheme.xSmallSize,
height: componentTheme.xSmallSize
width: componentTheme.containerSizeXs,
height: componentTheme.containerSizeXs
},
small: {
width: componentTheme.smallSize,
height: componentTheme.smallSize
width: componentTheme.containerSizeSm,
height: componentTheme.containerSizeSm
},
medium: {
width: componentTheme.mediumSize,
height: componentTheme.mediumSize
width: componentTheme.containerSizeMd,
height: componentTheme.containerSizeMd
},
large: {
width: componentTheme.largeSize,
height: componentTheme.largeSize
width: componentTheme.containerSizeLg,
height: componentTheme.containerSizeLg
}
}

const circleSizes = {
'x-small': {
width: componentTheme.xSmallSize,
height: componentTheme.xSmallSize
width: componentTheme.containerSizeXs,
height: componentTheme.containerSizeXs
},
small: {
width: componentTheme.smallSize,
height: componentTheme.smallSize
width: componentTheme.containerSizeSm,
height: componentTheme.containerSizeSm
},
medium: {
width: componentTheme.mediumSize,
height: componentTheme.mediumSize
width: componentTheme.containerSizeMd,
height: componentTheme.containerSizeMd
},
large: {
width: componentTheme.largeSize,
height: componentTheme.largeSize
width: componentTheme.containerSizeLg,
height: componentTheme.containerSizeLg
}
}
Copy link
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

These 2 are the same, but you are not using the spinnerSize.. tokens

delay,
renderTitle,
margin,
// elementRef,
Copy link
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

you can delete this

margin={this.props.margin}
data-cid="Spinner"
>
<div {...passthroughProps} css={styles?.spinner} ref={ref}>
Copy link
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

data-cid is missing from here

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

3 participants