Fixes for CodeQL

awawa-dev · awawa-dev · commit 04c67fbf4e1b · 2026-04-05T22:12:48.000+02:00
diff --git a/.github/workflows/push-master.yml b/.github/workflows/push-master.yml
@@ -255,7 +255,7 @@ jobs:
 
   analyze:
     name: Analyze (CodeQL)
-    runs-on: ubuntu-24.04
+    runs-on: ubuntu-latest
     if: ${{ vars.USE_CODEQL == 'true' && vars.USE_CODEQL || false }}
 
     permissions:
@@ -288,7 +288,7 @@ jobs:
   clang-tidy-clazy:
     name: Analyze (clang and clazy)
     runs-on: ubuntu-latest
-    if: ${{ vars.USE_CODEQL == 'true' && vars.USE_CODEQL || false }}
+    if: ${{ vars.USE_CODEQL == 'true' && vars.USE_CODEQL && false || false }}
 
     permissions:
       contents: read
diff --git a/CODE_OF_CONDUCT.md b/CODE_OF_CONDUCT.md
@@ -0,0 +1,36 @@
+# Code of Conduct & Project Rules
+
+## 1. Professional Expectations
+This is a free, open-source project maintained by volunteers in their spare time. To keep the project sustainable, we require all participants to adhere to basic professional etiquette:
+* **Start with a greeting.** A simple "hello" goes a long way.
+* **No demanding attitudes.** We do not have an SLA. Do not use terms like "URGENT", "ASAP", or "CRITICAL". Such issues will be closed immediately.
+* **Respect our time.** If you act with entitlement, you will be ignored or banned. We are here to develop software, not to provide 24/7 personal support.
+
+## 2. Hardware Compatibility & Support
+We provide a list of recommended hardware and verified LED drivers for a reason: [Wiki](https://github.com/awawa-dev/HyperHDR/wiki). 
+* **Unsupported Hardware:** If you choose to use hardware or drivers outside of our recommended specifications, you are responsible for your own troubleshooting.
+* **Testing Constraints:** We can only diagnose problems that can be reproduced on our verified test environments. If we don't own your specific hardware, usually we cannot help you.
+* **"Won't Fix":** Issues caused by ignoring hardware recommendations will be closed as "Unsupported".
+
+## 3. Policy on AI-Generated Content
+Do NOT post solutions, configurations, or "bug reports" generated by AI (ChatGPT, Claude, etc.). 
+* **No Hallucinations:** AI models frequently hallucinate details about this project that do not exist. 
+* **Verification:** If you bring AI-generated "advice" here and treat it as a fact over our documentation or the maintainers' advice, the conversation will be terminated. We will not spend time debunking AI-generated nonsense.
+
+## 4. Technical Requirements for Support
+We cannot help if we are missing data. If your report lacks the following, it will be closed without investigation:
+* **Detailed Environment:** Full hardware and software configuration.
+* **Complete Logs:** We require the **WHOLE log**, not just snippets you deem "relevant".
+* **Visuals:** Screenshots of the **video live preview** are mandatory for any LED rendering issues.
+* **Reproducibility:** Clear, step-by-step instructions to reproduce the issue on recommended hardware.
+
+## 5. Search Before You Ask
+Most questions are already answered in our [Wiki](https://github.com/awawa-dev/HyperHDR/wiki) and [Discussions](https://github.com/awawa-dev/HyperHDR/discussions). 
+
+## Consequences
+To maintain a productive environment, we reserve the right to:
+1. **Close** any issue or PR that violates these rules.
+2. **Lock** discussions that become unproductive or demanding.
+3. **Ban** users who demonstrate a pattern of entitlement, laziness, or disrespect.
+
+**By participating in this project, you acknowledge these rules. If you disagree with this approach, feel free to fork the code and maintain it according to your own standards.**
diff --git a/www/js/LedSetups/SetupPhilipsHue.js b/www/js/LedSetups/SetupPhilipsHue.js
@@ -165,7 +165,7 @@ function checkHueBridge(cb, hueUser)
                 {
                     useV2Api=parseInt(json.swversion)>1948086000&&useV2ApiConfig
                     conf_editor.getEditor("root.specificOptions.output").setValue(hueIPs[hueIPsinc].internalipaddress);
-                    $('#wiz_hue_discovered').html("Bridge: " + json.name + ", Modelid: " + json.modelid + ", API-Version: " + json.apiversion);
+                    $('#wiz_hue_discovered').html(DOMPurify.sanitize(`Bridge: ${json.name}, Modelid: ${json.modelid}, API-Version: ${json.apiversion}`));
                     cb(true);
                 }
                 else
@@ -604,7 +604,7 @@ function get_hue_groups()
                         groupIDs={};
                         for (const group of r.data) {
                             groupIDs[group.id] = group;
-                            $('.gidsb').append(createTableRowFlex([group.name + '<br> (' + group.id + ')', '<button class="btn btn-sm btn-primary" onClick=useGroupId("' + group.id + '")>' + $.i18n(useV2Api?'wiz_hue_e_use_entertainmentconfigurationid':'wiz_hue_e_use_groupid', group.id) + '</button>']));
+                            $('.gidsb').append(createTableRowFlex([DOMPurify.sanitize(`${group.name}<br> (${group.id})`), '<button class="btn btn-sm btn-primary" onClick=\'useGroupId(' + JSON.stringify(DOMPurify.sanitize(group.id)) + ')\'>' + $.i18n(useV2Api?'wiz_hue_e_use_entertainmentconfigurationid':'wiz_hue_e_use_groupid', group.id) + '</button>']));
                             gC++;
                         }
                         if (gC == 0)
@@ -636,7 +636,7 @@ function get_hue_groups()
                         {
                             if (r[groupid].type == 'Entertainment')
                             {
-                                $('.gidsb').append(createTableRowFlex([groupid + ' (' + r[groupid].name + ')', '<button class="btn btn-sm btn-primary" onClick=useGroupId(' + groupid + ')>' + $.i18n('wiz_hue_e_use_groupid', groupid) + '</button>']));
+                                $('.gidsb').append(createTableRowFlex([DOMPurify.sanitize(`${groupid} (${r[groupid].name})`), '<button class="btn btn-sm btn-primary" onClick=\'useGroupId(' + JSON.stringify(groupid) + ')\'>' + $.i18n('wiz_hue_e_use_groupid', groupid) + '</button>']));
                                 gC++;
                             }
                         }
@@ -755,7 +755,7 @@ function get_hue_lights()
                     let ipVal = encodeURI($("#ip").val());
                     let userVal = encodeURI($("#user").val());                  
                     let buttonLightLink = `<button class="btn btn-sm btn-primary" onClick=identify_hue_device("${ipVal}","${userVal}",${lightid})>***${$.i18n(useV2Api?'wiz_hue_identify':'wiz_hue_blinkblue', lightid)}</button>`;                 
-                    $('.lidsb').append(createTableRowFlex([`${lightid} (${descLightVal})`, selectLightControl, buttonLightLink]));
+                    $('.lidsb').append(createTableRowFlex([DOMPurify.sanitize(`${lightid} (${descLightVal})`), selectLightControl, buttonLightLink]));
                 }
 
                 if (hueType != 'philipshueentertainment')
diff --git a/www/js/grabber.js b/www/js/grabber.js
@@ -107,20 +107,20 @@ $(document).ready( function(){
 			firstMes = firstMes.replace("<m_odel>", backup.info.model).replace("<q_uality>", backup.info.quality);
 			secondMes = secondMes.replace("<sdrStat>", backup.info.sdrStat).replace("<sdrPoint>", backup.info.sdrPoint).replace("<hdrStat>", backup.info.hdrStat).replace("<hdrPoint>", backup.info.hdrPoint);
 			
-			$('#live_calibration_summary').html(firstMes + " "+secondMes);
+			$('#live_calibration_summary').html(DOMPurify.sanitize(`${firstMes} ${secondMes}`));
 			$('#wizp2').toggle(false);
 			$('#wizp3').toggle(true);
 		}
 		else
 		{
-			$('#live_calibration_log').html(backup.info.status.
+			$('#live_calibration_log').html(DOMPurify.sanitize(backup.info.status.
 											replace("Processing SDR frames:", $.i18n("edt_conf_stream_wizard_calibrating_message_SDR")).
 											replace("Processing HDR frames:", $.i18n("edt_conf_stream_wizard_calibrating_message_HDR")).
 											replace("Waiting for the first SDR frame", $.i18n("edt_conf_stream_wizard_calibrating_message_waiting")).
 											replace("Preparing for capturing SDR frame", $.i18n("edt_conf_stream_wizard_calibrating_message_prepare_SDR")).
 											replace("Preparing for capturing HDR frame", $.i18n("edt_conf_stream_wizard_calibrating_message_prepare_HDR")).
 											replace("Waiting for first HDR frame", $.i18n("edt_conf_stream_wizard_calibrating_message_waiting_first_HDR"))
-											);
+											));
 		}		
 	}
 	

Original file line number	Diff line number	Diff line change
`@@ -165,7 +165,7 @@ function checkHueBridge(cb, hueUser)`
`165`	`165`	`{`
`166`	`166`	`useV2Api=parseInt(json.swversion)>1948086000&&useV2ApiConfig`
`167`	`167`	`conf_editor.getEditor("root.specificOptions.output").setValue(hueIPs[hueIPsinc].internalipaddress);`
`168`		`- $('#wiz_hue_discovered').html("Bridge: " + json.name + ", Modelid: " + json.modelid + ", API-Version: " + json.apiversion);`
	`168`	+ $('#wiz_hue_discovered').html(DOMPurify.sanitize(`Bridge: ${json.name}, Modelid: ${json.modelid}, API-Version: ${json.apiversion}`));
`169`	`169`	`cb(true);`
`170`	`170`	`}`
`171`	`171`	`else`
`@@ -604,7 +604,7 @@ function get_hue_groups()`
`604`	`604`	`groupIDs={};`
`605`	`605`	`for (const group of r.data) {`
`606`	`606`	`groupIDs[group.id] = group;`
`607`		`- $('.gidsb').append(createTableRowFlex([group.name + '<br> (' + group.id + ')', '<button class="btn btn-sm btn-primary" onClick=useGroupId("' + group.id + '")>' + $.i18n(useV2Api?'wiz_hue_e_use_entertainmentconfigurationid':'wiz_hue_e_use_groupid', group.id) + '</button>']));`
	`607`	+ $('.gidsb').append(createTableRowFlex([DOMPurify.sanitize(`${group.name}<br> (${group.id})`), '<button class="btn btn-sm btn-primary" onClick=\'useGroupId(' + JSON.stringify(DOMPurify.sanitize(group.id)) + ')\'>' + $.i18n(useV2Api?'wiz_hue_e_use_entertainmentconfigurationid':'wiz_hue_e_use_groupid', group.id) + '</button>']));
`608`	`608`	`gC++;`
`609`	`609`	`}`
`610`	`610`	`if (gC == 0)`
`@@ -636,7 +636,7 @@ function get_hue_groups()`
`636`	`636`	`{`
`637`	`637`	`if (r[groupid].type == 'Entertainment')`
`638`	`638`	`{`
`639`		`- $('.gidsb').append(createTableRowFlex([groupid + ' (' + r[groupid].name + ')', '<button class="btn btn-sm btn-primary" onClick=useGroupId(' + groupid + ')>' + $.i18n('wiz_hue_e_use_groupid', groupid) + '</button>']));`
	`639`	+ $('.gidsb').append(createTableRowFlex([DOMPurify.sanitize(`${groupid} (${r[groupid].name})`), '<button class="btn btn-sm btn-primary" onClick=\'useGroupId(' + JSON.stringify(groupid) + ')\'>' + $.i18n('wiz_hue_e_use_groupid', groupid) + '</button>']));
`640`	`640`	`gC++;`
`641`	`641`	`}`
`642`	`642`	`}`
`@@ -755,7 +755,7 @@ function get_hue_lights()`
`755`	`755`	`let ipVal = encodeURI($("#ip").val());`
`756`	`756`	`let userVal = encodeURI($("#user").val());`
`757`	`757`	let buttonLightLink = `<button class="btn btn-sm btn-primary" onClick=identify_hue_device("${ipVal}","${userVal}",${lightid})>***${$.i18n(useV2Api?'wiz_hue_identify':'wiz_hue_blinkblue', lightid)}</button>`;
`758`		- $('.lidsb').append(createTableRowFlex([`${lightid} (${descLightVal})`, selectLightControl, buttonLightLink]));
	`758`	+ $('.lidsb').append(createTableRowFlex([DOMPurify.sanitize(`${lightid} (${descLightVal})`), selectLightControl, buttonLightLink]));
`759`	`759`	`}`
`760`	`760`
`761`	`761`	`if (hueType != 'philipshueentertainment')`
Original file line number	Diff line number	Diff line change
`@@ -107,20 +107,20 @@ $(document).ready( function(){`
`107`	`107`	`firstMes = firstMes.replace("<m_odel>", backup.info.model).replace("<q_uality>", backup.info.quality);`
`108`	`108`	`secondMes = secondMes.replace("<sdrStat>", backup.info.sdrStat).replace("<sdrPoint>", backup.info.sdrPoint).replace("<hdrStat>", backup.info.hdrStat).replace("<hdrPoint>", backup.info.hdrPoint);`
`109`	`109`
`110`		`- $('#live_calibration_summary').html(firstMes + " "+secondMes);`
	`110`	+ $('#live_calibration_summary').html(DOMPurify.sanitize(`${firstMes} ${secondMes}`));
`111`	`111`	`$('#wizp2').toggle(false);`
`112`	`112`	`$('#wizp3').toggle(true);`
`113`	`113`	`}`
`114`	`114`	`else`
`115`	`115`	`{`
`116`		`- $('#live_calibration_log').html(backup.info.status.`
	`116`	`+ $('#live_calibration_log').html(DOMPurify.sanitize(backup.info.status.`
`117`	`117`	`replace("Processing SDR frames:", $.i18n("edt_conf_stream_wizard_calibrating_message_SDR")).`
`118`	`118`	`replace("Processing HDR frames:", $.i18n("edt_conf_stream_wizard_calibrating_message_HDR")).`
`119`	`119`	`replace("Waiting for the first SDR frame", $.i18n("edt_conf_stream_wizard_calibrating_message_waiting")).`
`120`	`120`	`replace("Preparing for capturing SDR frame", $.i18n("edt_conf_stream_wizard_calibrating_message_prepare_SDR")).`
`121`	`121`	`replace("Preparing for capturing HDR frame", $.i18n("edt_conf_stream_wizard_calibrating_message_prepare_HDR")).`
`122`	`122`	`replace("Waiting for first HDR frame", $.i18n("edt_conf_stream_wizard_calibrating_message_waiting_first_HDR"))`
`123`		`- );`
	`123`	`+ ));`
`124`	`124`	`}`
`125`	`125`	`}`
`126`	`126`