| CVE | Vulnerability name | Date | Responsible Security Disclosure by | Vulnerabilities |
|---|---|---|---|---|
|
-
|
IdentityBleed |
2026-07-22 |
GitHub CodeQL (code scanning alert #424) and xet7 (fix)
Automated code scanning flagged the identity (no-op) replacement. |
|
A unit test that verifies the Admin Panel → Problems page renders one menu entry per
report stream (tests/securityLog.test.cjs) built the expected CSS-class regex
from a report id like this:
// vulnerable — replace('report-', 'report-') is a no-op
assert.ok(new RegExp('js-' + id.replace('report-', 'report-')).test(rj), id + ' menu entry');
id.replace('report-', 'report-') replaces the substring report-
with the exact same text, so it returns the string unchanged. GitHub CodeQL reports this as
js/identity-replacement: replacing a value with itself is almost always a
mistake — either the author meant to transform the string (and the transform is missing/
wrong), or the replace is dead code that misleads the reader into thinking a
transformation happens.
Here it was dead code: the id already had the exact form the regex needed, so the
replace did nothing and the test happened to pass. There was no runtime
exposure — this is test-only code — but the no-op is genuinely wrong and hides intent.
Fix: drop the dead replace and match on 'js-' + id
directly:
// fixed — match the id directly, no misleading no-op
assert.ok(new RegExp('js-' + id).test(rj), id + ' menu entry');
CodeQL rule js/identity-replacement was resolved by this change, and the test
still asserts exactly the same thing (a js-report-* class per stream).