Security: fix CodeQL alerts (#22)

aleksei-semikozov · web-flow · commit 3a23d15a4abc · 2026-01-26T06:22:45.000-03:00
diff --git a/.github/workflows/asset-size.yml b/.github/workflows/asset-size.yml
@@ -6,6 +6,9 @@ jobs:
   compare:
     timeout-minutes: 15
     runs-on: ubuntu-latest
+    permissions:
+      contents: read
+      pull-requests: write
 
     steps:
       - uses: actions/checkout@v4
diff --git a/.github/workflows/tests.yml b/.github/workflows/tests.yml
@@ -10,6 +10,8 @@ jobs:
   test:
     timeout-minutes: 10
     name: Node v${{ matrix.node-version }} on ${{ matrix.os }}
+    permissions:
+      contents: read
     strategy:
       fail-fast: false
       matrix:
@@ -39,6 +41,8 @@ jobs:
     timeout-minutes: 15
     name: Measure performance impact of changes
     runs-on: ubuntu-latest
+    permissions:
+      contents: read
 
     steps:
       - uses: actions/checkout@v4
@@ -55,6 +59,8 @@ jobs:
     timeout-minutes: 15
     name: Ensure typescript compatibility
     runs-on: ubuntu-latest
+    permissions:
+      contents: read
 
     steps:
       - uses: actions/checkout@v4
diff --git a/lib/utils/col-cache.js b/lib/utils/col-cache.js
@@ -214,10 +214,30 @@ const colCache = {
 
   // convert [sheetName!][$]col[$]row[[$]col[$]row] into address or range structures
   decodeEx(value) {
-    const groups = value.match(/(?:(?:(?:'((?:[^']|'')*)')|([^'^ !]*))!)?(.*)/);
+    let sheetName;
+    let reference = value;
 
-    const sheetName = groups[1] || groups[2]; // Qouted and unqouted groups
-    const reference = groups[3]; // Remaining address
+    if (value.startsWith('\'')) {
+      for (let i = 1; i < value.length; i++) {
+        if (value[i] === '\'') {
+          if (i + 1 < value.length && value[i + 1] === '\'') {
+            i++;
+            continue;
+          }
+          if (i + 1 < value.length && value[i + 1] === '!') {
+            sheetName = value.slice(1, i).replace(/''/g, '\'');
+            reference = value.slice(i + 2);
+          }
+          break;
+        }
+      }
+    } else {
+      const bang = value.indexOf('!');
+      if (bang > 0) {
+        sheetName = value.slice(0, bang);
+        reference = value.slice(bang + 1);
+      }
+    }
 
     const parts = reference.split(':');
     if (parts.length > 1) {
diff --git a/spec/manual/public/index.html b/spec/manual/public/index.html
@@ -3,7 +3,9 @@
 <head>
   <meta charset="UTF-8">
   <title>Browserify</title>
-  <script src="https://cdnjs.cloudflare.com/ajax/libs/babel-polyfill/6.26.0/polyfill.js"></script>
+  <script src="https://cdnjs.cloudflare.com/ajax/libs/babel-polyfill/6.26.0/polyfill.js"
+    integrity="sha512-w+OmM1I6bMDUnX5zLWiRiV+3KkhSxvR3Fv9BNoicC3/BtC0xtU6jw/qIv+jjz2lTlFSUMXkL7OM4OmHR/PHkDg=="
+    crossorigin="anonymous" referrerpolicy="no-referrer"></script>
   <script src="exceljs.js"></script>
   <script>
     function go() {
diff --git a/spec/manual/public/index.min.html b/spec/manual/public/index.min.html
@@ -3,7 +3,9 @@
 <head>
   <meta charset="UTF-8">
   <title>Browserify</title>
-  <script src="https://cdnjs.cloudflare.com/ajax/libs/babel-polyfill/6.26.0/polyfill.min.js"></script>
+  <script src="https://cdnjs.cloudflare.com/ajax/libs/babel-polyfill/6.26.0/polyfill.min.js"
+    integrity="sha512-vDTLyifjBBdmGeJrJMO7w+qbbk+7uyoKsUxkhgxPtn3YShSVspezU0EXf780txBgNXzfKkEt7a3RhLs7NmInJQ=="
+    crossorigin="anonymous" referrerpolicy="no-referrer"></script>
   <script src="exceljs.min.js"></script>
   <script>
     function go() {
