From ff11496cf1fa68910a81feab44a7c7e616a1f214 Mon Sep 17 00:00:00 2001
From: Bruno Borges <brborges@microsoft.com>
Date: Wed, 29 Jul 2026 16:18:54 -0400
Subject: [PATCH] Fix CodeQL comment tag filter finding

Patch is-unsafe's XML comment-close detector during builds so generated bundles recognize both HTML comment end forms and satisfy CodeQL until the dependency publishes a fix.

Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>

Copilot-Session: 277302b1-aa95-4012-817b-9752cdaee14e
---
 dist/cleanup/index.js       |  2 +-
 dist/setup/index.js         |  2 +-
 package.json                |  2 +-
 scripts/patch-is-unsafe.mjs | 20 ++++++++++++++++++++
 4 files changed, 23 insertions(+), 3 deletions(-)
 create mode 100644 scripts/patch-is-unsafe.mjs

diff --git a/dist/cleanup/index.js b/dist/cleanup/index.js
index 3d6bd1593..25b91ffa4 100644
--- a/dist/cleanup/index.js
+++ b/dist/cleanup/index.js
@@ -60140,7 +60140,7 @@ const XML_PATTERNS = [
   {
     id: 'xml-comment-close',
     description: '--> closes an enclosing XML comment',
-    pattern: /-->/,
+    pattern: /--!?>/,
   },
   {
     id: 'xml-pi-close',
diff --git a/dist/setup/index.js b/dist/setup/index.js
index a8f9406d2..256733140 100644
--- a/dist/setup/index.js
+++ b/dist/setup/index.js
@@ -91195,7 +91195,7 @@ const XML_PATTERNS = [
   {
     id: 'xml-comment-close',
     description: '--> closes an enclosing XML comment',
-    pattern: /-->/,
+    pattern: /--!?>/,
   },
   {
     id: 'xml-pi-close',
diff --git a/package.json b/package.json
index abe6c7cdd..9770c8d28 100644
--- a/package.json
+++ b/package.json
@@ -9,7 +9,7 @@
     "node": ">=24.0.0"
   },
   "scripts": {
-    "build": "ncc build -o dist/setup src/setup-java.ts && ncc build -o dist/cleanup src/cleanup-java.ts",
+    "build": "node scripts/patch-is-unsafe.mjs && ncc build -o dist/setup src/setup-java.ts && ncc build -o dist/cleanup src/cleanup-java.ts",
     "format": "prettier --no-error-on-unmatched-pattern --write \"**/*.{ts,yml,yaml}\"",
     "format-check": "prettier --no-error-on-unmatched-pattern --check \"**/*.{ts,yml,yaml}\"",
     "lint": "eslint \"**/*.ts\"",
diff --git a/scripts/patch-is-unsafe.mjs b/scripts/patch-is-unsafe.mjs
new file mode 100644
index 000000000..5a9f09ea9
--- /dev/null
+++ b/scripts/patch-is-unsafe.mjs
@@ -0,0 +1,20 @@
+import {readFile, writeFile} from 'node:fs/promises';
+
+const sourcePath = new URL('../node_modules/is-unsafe/src/contexts/xml.js', import.meta.url);
+const vulnerablePattern = 'pattern: /-->/,';
+const safePattern = 'pattern: /--!?>/,';
+const source = await readFile(sourcePath, 'utf8');
+
+// CodeQL treats this XML detector as an incomplete HTML comment-end filter.
+if (source.includes(safePattern)) {
+  process.exit(0);
+}
+
+const occurrences = source.split(vulnerablePattern).length - 1;
+if (occurrences !== 1) {
+  throw new Error(
+    `Expected one ${JSON.stringify(vulnerablePattern)} in ${sourcePath.pathname}, found ${occurrences}`
+  );
+}
+
+await writeFile(sourcePath, source.replace(vulnerablePattern, safePattern));