Skip to content

GPT integration #282

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom
Draft
ChristianPavilonis wants to merge 4 commits into
base: main
Choose a base branch
from
Draft

GPT integration #282

ChristianPavilonis wants to merge 4 commits into from

Conversation

@ChristianPavilonis
Copy link
Collaborator

@ChristianPavilonis ChristianPavilonis commented Feb 10, 2026

  • initi
  • simplify
  • more proxies
  • docs

github-advanced-security[bot]
github-advanced-security bot found potential problems Feb 10, 2026
View reviewed changes
crates/js/lib/src/integrations/gpt/script_guard.ts

/** Google ad-serving domains whose URLs should be proxied (exact match). */
const GPT_DOMAINS = [
'securepubads.g.doubleclick.net',

Check failure

Code scanning / CodeQL

Incomplete regular expression for hostnames High

This string, which is used as a regular expression
here
Loading
, has an unescaped '.' before 'doubleclick.net', so it might match more hosts than expected.

Copilot Autofix

AI about 15 hours ago

Copilot could not generate an autofix suggestion

Copilot could not generate an autofix suggestion for this alert. Try pushing a new commit or if the problem persists contact support.

crates/js/lib/src/integrations/gpt/script_guard.ts
/** Google ad-serving domains whose URLs should be proxied (exact match). */
const GPT_DOMAINS = [
'securepubads.g.doubleclick.net',
'pagead2.googlesyndication.com',

Check failure

Code scanning / CodeQL

Incomplete regular expression for hostnames High

This string, which is used as a regular expression
here
Loading
, has an unescaped '.' before 'googlesyndication.com', so it might match more hosts than expected.

Copilot Autofix

AI about 15 hours ago

Copilot could not generate an autofix suggestion

Copilot could not generate an autofix suggestion for this alert. Try pushing a new commit or if the problem persists contact support.

crates/js/lib/src/integrations/gpt/script_guard.ts
const GPT_DOMAINS = [
'securepubads.g.doubleclick.net',
'pagead2.googlesyndication.com',
'tpc.googlesyndication.com',

Check failure

Code scanning / CodeQL

Incomplete regular expression for hostnames High

This string, which is used as a regular expression
here
Loading
, has an unescaped '.' before 'googlesyndication.com', so it might match more hosts than expected.

Copilot Autofix

AI about 15 hours ago

Copilot could not generate an autofix suggestion

Copilot could not generate an autofix suggestion for this alert. Try pushing a new commit or if the problem persists contact support.

crates/js/lib/src/integrations/gpt/script_guard.ts
'pagead2.googlesyndication.com',
'tpc.googlesyndication.com',
'googletagservices.com',
'www.googletagservices.com',

Check failure

Code scanning / CodeQL

Incomplete regular expression for hostnames High

This string, which is used as a regular expression
here
Loading
, has an unescaped '.' before 'googletagservices.com', so it might match more hosts than expected.

Copilot Autofix

AI about 15 hours ago

Copilot could not generate an autofix suggestion

Copilot could not generate an autofix suggestion for this alert. Try pushing a new commit or if the problem persists contact support.

crates/js/lib/src/integrations/gpt/script_guard.ts
'tpc.googlesyndication.com',
'googletagservices.com',
'www.googletagservices.com',
'cm.g.doubleclick.net',

Check failure

Code scanning / CodeQL

Incomplete regular expression for hostnames High

This string, which is used as a regular expression
here
Loading
, has an unescaped '.' before 'doubleclick.net', so it might match more hosts than expected.

Copilot Autofix

AI about 15 hours ago

Copilot could not generate an autofix suggestion

Copilot could not generate an autofix suggestion for this alert. Try pushing a new commit or if the problem persists contact support.

crates/js/lib/src/integrations/gpt/script_guard.ts
'cm.g.doubleclick.net',
'ep1.adtrafficquality.google',
'ep2.adtrafficquality.google',
'www.googleadservices.com',

Check failure

Code scanning / CodeQL

Incomplete regular expression for hostnames High

This string, which is used as a regular expression
here
Loading
, has an unescaped '.' before 'googleadservices.com', so it might match more hosts than expected.

Copilot Autofix

AI about 15 hours ago

Copilot could not generate an autofix suggestion

Copilot could not generate an autofix suggestion for this alert. Try pushing a new commit or if the problem persists contact support.

crates/js/lib/src/integrations/gpt/script_guard.ts
if (lower.includes(domain)) {
const prefix = hostPrefixForDomain(domain);
return originalUrl.replace(
new RegExp(`https?://(?:www\\.)?${domain.replace(/\./g, '\\.')}`, 'i'),

Check failure

Code scanning / CodeQL

Incomplete string escaping or encoding High

This does not escape backslash characters in the input.

Copilot Autofix

AI about 15 hours ago

In general, when building a regular expression from a string, that string must be fully escaped for regex metacharacters, including the backslash, so that it is treated purely as a literal. Instead of partially escaping only dots with domain.replace(/\./g, '\\.'), we should pass domain through a small helper that escapes all regex special characters (e.g. [.*+?^${}()|[\]\\]) before interpolating into new RegExp(...).

For this file, the best minimal fix is:

  1. Add a local helper function, e.g. escapeRegExp, that takes a string and returns it with all regex metacharacters escaped. A standard implementation is s.replace(/[.*+?^${}()|[\]\\]/g, '\\$&').
  2. Use this helper on domain when constructing the RegExp in the fallback of rewriteUrl, replacing domain.replace(/\./g, '\\.') with escapeRegExp(domain).
  3. Place the helper near other utility functions (e.g. after hostPrefixForDomain) to keep the code organized.

No behavior changes for current hard-coded domains, but the code becomes correct and safe for any future domains.

Suggested changeset 1
crates/js/lib/src/integrations/gpt/script_guard.ts

Autofix patch

Autofix patch
Run the following command in your local git repository to apply this patch
cat << 'EOF' | git apply
diff --git a/crates/js/lib/src/integrations/gpt/script_guard.ts b/crates/js/lib/src/integrations/gpt/script_guard.ts
--- a/crates/js/lib/src/integrations/gpt/script_guard.ts
+++ b/crates/js/lib/src/integrations/gpt/script_guard.ts
@@ -80,6 +80,13 @@
 }
 
 /**
+ * Escape a string so it can be safely used inside a RegExp as a literal.
+ */
+function escapeRegExp(input: string): string {
+  return input.replace(/[.*+?^${}()|[\]\\]/g, '\\$&');
+}
+
+/**
  * Rewrite a GPT URL to the first-party proxy, preserving path, query, and
  * fragment. Applies the correct host-prefix for domains that need one.
  */
@@ -98,7 +105,7 @@
       if (lower.includes(domain)) {
         const prefix = hostPrefixForDomain(domain);
         return originalUrl.replace(
-          new RegExp(`https?://(?:www\\.)?${domain.replace(/\./g, '\\.')}`, 'i'),
+          new RegExp(`https?://(?:www\\.)?${escapeRegExp(domain)}`, 'i'),
           `${window.location.protocol}//${window.location.host}${PROXY_PREFIX}${prefix}`,
         );
       }
EOF
@@ -80,6 +80,13 @@
}

/**
* Escape a string so it can be safely used inside a RegExp as a literal.
*/
function escapeRegExp(input: string): string {
return input.replace(/[.*+?^${}()|[\]\\]/g, '\\$&');
}

/**
* Rewrite a GPT URL to the first-party proxy, preserving path, query, and
* fragment. Applies the correct host-prefix for domains that need one.
*/
@@ -98,7 +105,7 @@
if (lower.includes(domain)) {
const prefix = hostPrefixForDomain(domain);
return originalUrl.replace(
new RegExp(`https?://(?:www\\.)?${domain.replace(/\./g, '\\.')}`, 'i'),
new RegExp(`https?://(?:www\\.)?${escapeRegExp(domain)}`, 'i'),
`${window.location.protocol}//${window.location.host}${PROXY_PREFIX}${prefix}`,
);
}
Copilot is powered by AI and may make mistakes. Always verify output.
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

@ChristianPavilonis ChristianPavilonis

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

1 participant

@ChristianPavilonis