py/ai-job-search
1
0 Fork 0
mirror of https://github.com/MadsLorentzen/ai-job-search.git synced 2026-11-02 13:12:50 +00:00
Code Issues Packages Projects Releases Wiki Activity

fix(posting-guard): read style values like a browser and treat a collapsed, clipped box as hidden (#709)

Browse Source 
* fix(posting-guard): read style values like a browser and treat a collapsed, clipped box as hidden

The hidden-style regex ran on the raw attribute value, so
"display:none" (entity-encoded colon) and "display:/**/none" (a CSS
comment inside the declaration) both hid the content in a browser while
the guard showed it under a clean verdict. A zero-height or zero-width
box with overflow:hidden, the other common way to hide a block, was not
a hidden style at all.

Entity-decode and comment-strip the value before matching, and count a
collapsed box as hidden only when both halves are present: overflow:
hidden alone is on most cards and height:0 alone is a spacer. Three new
Bypasses cases (seven subtests fail on master) plus a calibration case
pinning that either half alone stays visible.

* changelog: place the #709 entry under [Unreleased]

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

---------

Co-authored-by: Mads Lorentzen <madslorentzen_17@hotmail.com>
Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
This commit is contained in:
Ayobami AdegokeClaude Opus 5.5Mads Lorentzen
 authored and GitHub committed 2026-10-21 07:19:47 +02:00
1 parent e608daf80c
commit b67eb9e05a
3 files changed
+59 -3
Download Patch File Download Diff File Expand all files Collapse all files

No files matched your search

CHANGELOG.md
+11
View File
@@ -415,6 +415,17 @@ per-file diff commands.
lines, six of which fail on master, and ten prose lines with the same words that must stay
clean.
- **`posting_guard.py` reads a style attribute the way a browser does and treats a collapsed,
clipped box as hidden** (#709, `tools/posting_guard.py`, `tests/test_posting_guard.py`) - the hidden-style
regex ran on the raw attribute value, so `display&#58;none` (entity-encoded colon) and
`display:/**/none` (a CSS comment inside the declaration) both hid the content in a browser
while the guard showed it under a clean verdict; and a zero-height or zero-width box with
`overflow:hidden`, the other common way to hide a block, was not a hidden style at all.
The value is now entity-decoded and comment-stripped before matching, and a collapsed box
counts as hidden only when both halves are present, because `overflow:hidden` alone is on
most cards and `height:0` alone is a spacer. Three new `Bypasses` cases, seven subtests
failing on master, plus a calibration case pinning that either half alone stays visible.
### Security
- **CI no longer leaves the job token in `.git/config` or expands a PR-controlled name into a