Potential fix for code scanning alert no. 4: Incomplete string escaping or encoding

jonathansantilli · github-advanced-security[bot] · web-flow · commit e0636164f0da · 2026-03-07T20:17:43.000Z
Co-authored-by: Copilot Autofix powered by AI &lt;62310815+github-advanced-security[bot]@users.noreply.github.com&gt;
diff --git a/src/layer3-dynamic/resource-fetcher.ts b/src/layer3-dynamic/resource-fetcher.ts
@@ -48,7 +48,7 @@ function defaultDeps(): ResourceFetcherDeps {
 function endpointFor(request: ResourceRequest): string {
   if (request.kind === "npm") {
     const pkg = request.locator.startsWith("@")
-      ? request.locator.replace("/", "%2f")
+      ? request.locator.replace(/\//g, "%2f")
       : request.locator;
     return `https://registry.npmjs.org/${pkg}`;
   }

Original file line number	Diff line number	Diff line change
`@@ -48,7 +48,7 @@ function defaultDeps(): ResourceFetcherDeps {`
`48`	`48`	`function endpointFor(request: ResourceRequest): string {`
`49`	`49`	`if (request.kind === "npm") {`
`50`	`50`	`const pkg = request.locator.startsWith("@")`
`51`		`- ? request.locator.replace("/", "%2f")`
	`51`	`+ ? request.locator.replace(/\//g, "%2f")`
`52`	`52`	`: request.locator;`
`53`	`53`	return `https://registry.npmjs.org/${pkg}`;
`54`	`54`	`}`