fix(caniuse): handle wf- prefixed web-features IDs by marcoscaceres · Pull Request #494 · speced/respec-web-services

marcoscaceres · 2026-04-25T10:35:54Z

Summary

Strip wf- prefix and retry when caniuse feature lookup fails
Return structured JSON 404 with helpful hint for web-features IDs
Only silence ENOENT errors, log everything else

Closes #467

Copilot

Pull request overview

Updates the caniuse feature lookup to better support caniuse’s newer wf- (web-features) identifiers and improves not-found responses.

Changes:

Add fallback lookup logic that strips the wf- prefix when an initial caniuse feature lookup fails.
Return a JSON 404 response from the /caniuse/:feature route with an actionable hint when wf- is used.
Suppress logging for ENOENT (missing feature file) while continuing to log other read/parse errors.

Reviewed changes

Copilot reviewed 2 out of 2 changed files in this pull request and generated 1 comment.

File	Description
routes/caniuse/lib/index.ts	Adds `wf-` fallback lookup and refines error logging for missing feature files.
routes/caniuse/feature.ts	Returns a structured JSON 404 with a `wf-`-specific hint; removes an unused import.

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

Copilot

Pull request overview

Copilot reviewed 2 out of 2 changed files in this pull request and generated 3 comments.

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

Copilot

Pull request overview

Copilot reviewed 2 out of 2 changed files in this pull request and generated no new comments.

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

Copilot

Pull request overview

Copilot reviewed 2 out of 2 changed files in this pull request and generated no new comments.

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

Copilot

Pull request overview

Copilot reviewed 2 out of 2 changed files in this pull request and generated 3 comments.

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

When a caniuse feature lookup fails with a wf- prefix, strip the prefix and retry. Returns a clear 404 if no match is found. Closes #467

Copilot

Pull request overview

Copilot reviewed 2 out of 2 changed files in this pull request and generated 1 comment.

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

… scripting' Co-authored-by: Copilot Autofix powered by AI <62310815+github-advanced-security[bot]@users.noreply.github.com>

… route 404 shape Agent-Logs-Url: https://github.com/speced/respec-web-services/sessions/752610b5-b640-4671-9dbe-750f629a1168

Copilot · 2026-04-27T08:46:21Z

@copilot can you fix the unresolved problem

Added Jasmine test coverage in commit 1c6a717:

tests/routes/caniuse/lib/index.test.js — 8 specs covering getData: normal feature, wf- fallback, wf- edge case ("wf-"), path traversal rejection, cache population under the original wf- key, and subsequent requests served from cache without extra disk I/O.
tests/routes/caniuse/feature.test.js — 5 specs covering the /:feature route: JSON 404 shape for a missing feature, wf- hint included for wf-... IDs, no hint for the "wf-" edge case, 200 for a known feature, and successful wf- fallback through the route.

All 54 specs (14 new caniuse + 40 existing) pass.

Agent-Logs-Url: https://github.com/speced/respec-web-services/sessions/02732062-1dbf-49cb-93a5-e30f1622d303

marcoscaceres · 2026-04-27T09:00:50Z

@copilot Can you review this and fix any issues that come up?

Agent-Logs-Url: https://github.com/speced/respec-web-services/sessions/fd5e571e-1895-44ad-89f4-bd8ebec18f41

marcoscaceres · 2026-04-27T14:54:41Z

@copilot can you confirm all your feedback has been addressed and resolved everything that has? Can you fix anything that wasn’t addressed and resolve those comments.

Copilot · 2026-04-27T14:57:42Z

@copilot can you confirm all your feedback has been addressed and resolved everything that has? Can you fix anything that wasn’t addressed and resolve those comments.

All feedback has been addressed. Here's a complete summary:

Security fixes

Path traversal: getData() validates feature names with /^[a-z0-9][a-z0-9._-]*$/i before using them in file paths (commit 73a407e)
XSS: HTML 404 messages in index.ts are escaped with escape-html (commit db579de)
CodeQL type confusion: runtime typeof feature !== "string" guard added in getData() (commit 2c03d80)

Logic improvements

wf- fallback only runs when feature.length > 3 to avoid empty-string file lookups
Successful wf- fallback is cached under the original key to avoid repeated disk I/O
readFeatureFile only silences ENOENT; JSON parse/permission errors are rethrown as 500s
browsers=all sentinel is passed through before splitting in the legacy route
Legacy route respects format=html on error paths (HTML 404) vs JSON format (JSON 404)

Consistent JSON error shapes

feature.ts 404 and catch block both return { error: "..." } JSON (catch now returns 500, not 404)
index.ts legacy route 404 returns JSON when format=json, HTML when format=html

Test coverage (all 55 specs pass, CI Tests ✅ CodeQL ✅)

tests/routes/caniuse/lib/index.test.js: 9 specs (getData wf- fallback, caching, path traversal, edge cases)
tests/routes/caniuse/feature.test.js: 6 specs (404 shape, wf- hint, 500 on malformed JSON, successful responses)

marcoscaceres · 2026-05-05T04:18:23Z

@copilot Can you rebase this on main and resolve the merge conflicts?

@sidvishnoi

- Merges all recent main branch commits (TypeScript 6, baseline API, xref improvements, misc/cache tests, etc.) - Reverts deprecated GET /caniuse?feature= route to its original form per @sidvishnoi's review (route is deprecated, keep as-is) - Removes escape-html direct dependency (only needed for deprecated route changes that were reverted; still available as transitive dep of express) - Resolves merge conflicts in feature.ts and pnpm-lock.yaml Agent-Logs-Url: https://github.com/speced/respec-web-services/sessions/1c7aab3b-9248-4f65-950f-099f23b327e7

Copilot · 2026-05-05T04:28:54Z

@copilot Can you rebase this on main and resolve the merge conflicts?

Done in commit 742c251. Merged origin/main into the branch (TypeScript 6, baseline API, xref improvements, etc.), resolved conflicts in routes/caniuse/feature.ts and pnpm-lock.yaml, and pushed. All 141 specs pass, CodeQL 0 alerts.

marcoscaceres · 2026-05-05T13:03:39Z

@copilot can you fix the merge conflicts?

Resolves conflict in routes/caniuse/feature.ts: keep JSON 500 error response (our improvement) over the old text/plain response from main. Co-authored-by: marcoscaceres <870154+marcoscaceres@users.noreply.github.com>

Copilot · 2026-05-05T13:07:29Z

@copilot can you fix the merge conflicts?

Fixed in commit 48c7ce6. The previous merge (742c251) wasn't a proper two-parent merge commit, so GitHub still saw conflicts. This commit is a true merge of origin/main with the single conflict in feature.ts (catch block) resolved by keeping our JSON 500 response. All 141 specs pass.

github-advanced-security AI found potential problems Apr 25, 2026

View reviewed changes

Comment thread routes/caniuse/lib/index.ts Fixed

marcoscaceres force-pushed the fix/caniuse-web-features branch from 5ed688e to b350086 Compare April 25, 2026 12:22

github-advanced-security AI found potential problems Apr 25, 2026

View reviewed changes

Comment thread routes/caniuse/lib/index.ts Fixed

marcoscaceres requested a review from Copilot April 25, 2026 12:26

Copilot started reviewing on behalf of marcoscaceres April 25, 2026 12:26 View session

Copilot AI reviewed Apr 25, 2026

View reviewed changes

Comment thread routes/caniuse/lib/index.ts Outdated

marcoscaceres force-pushed the fix/caniuse-web-features branch from b350086 to 49f7576 Compare April 25, 2026 12:37

marcoscaceres requested a review from Copilot April 25, 2026 13:09

Copilot started reviewing on behalf of marcoscaceres April 25, 2026 13:09 View session

Copilot AI reviewed Apr 25, 2026

View reviewed changes

Comment thread routes/caniuse/lib/index.ts

Comment thread routes/caniuse/lib/index.ts Outdated

Comment thread routes/caniuse/lib/index.ts Outdated

marcoscaceres requested a review from Copilot April 25, 2026 13:37

Copilot started reviewing on behalf of marcoscaceres April 25, 2026 13:38 View session

Copilot AI reviewed Apr 25, 2026

View reviewed changes

marcoscaceres commented Apr 25, 2026

View reviewed changes

Comment thread routes/caniuse/lib/index.ts Outdated

marcoscaceres force-pushed the fix/caniuse-web-features branch from b52481d to 08728e1 Compare April 26, 2026 00:09

marcoscaceres requested a review from Copilot April 26, 2026 00:15

Copilot started reviewing on behalf of marcoscaceres April 26, 2026 00:16 View session

marcoscaceres force-pushed the fix/caniuse-web-features branch from 08728e1 to 43ab10e Compare April 26, 2026 00:17

Copilot AI reviewed Apr 26, 2026

View reviewed changes

marcoscaceres force-pushed the fix/caniuse-web-features branch 2 times, most recently from 4e21c0a to 5aa29ab Compare April 26, 2026 01:07

marcoscaceres requested a review from Copilot April 26, 2026 01:20

Copilot started reviewing on behalf of marcoscaceres April 26, 2026 01:20 View session

Copilot AI reviewed Apr 26, 2026

View reviewed changes

Comment thread routes/caniuse/lib/index.ts Outdated

Comment thread routes/caniuse/feature.ts Outdated

Comment thread routes/caniuse/feature.ts

fix(caniuse): handle wf- prefixed web-features IDs

805a603

When a caniuse feature lookup fails with a wf- prefix, strip the prefix and retry. Returns a clear 404 if no match is found. Closes #467

marcoscaceres force-pushed the fix/caniuse-web-features branch from 5aa29ab to 805a603 Compare April 26, 2026 03:03

marcoscaceres requested a review from Copilot April 26, 2026 03:03

Copilot started reviewing on behalf of marcoscaceres April 26, 2026 03:03 View session

github-advanced-security AI found potential problems Apr 26, 2026

View reviewed changes

Comment thread routes/caniuse/lib/index.ts Fixed

Comment thread routes/caniuse/lib/index.ts Fixed

Copilot AI reviewed Apr 26, 2026

View reviewed changes

Comment thread routes/caniuse/lib/index.ts Outdated

github-advanced-security AI found potential problems Apr 27, 2026

View reviewed changes

Comment thread routes/caniuse/index.ts Fixed

marcoscaceres and others added 2 commits April 27, 2026 18:44

Potential fix for pull request finding 'CodeQL / Reflected cross-site…

1a77b51

… scripting' Co-authored-by: Copilot Autofix powered by AI <62310815+github-advanced-security[bot]@users.noreply.github.com>

test(caniuse): add Jasmine tests for getData wf- fallback and feature…

1c6a717

… route 404 shape Agent-Logs-Url: https://github.com/speced/respec-web-services/sessions/752610b5-b640-4671-9dbe-750f629a1168

Copilot finished work on behalf of marcoscaceres April 27, 2026 08:48

Copilot started work on behalf of marcoscaceres April 27, 2026 08:48 View session

fix(deps): update pnpm-lock.yaml to include escape-html dependency

e13804a

Agent-Logs-Url: https://github.com/speced/respec-web-services/sessions/02732062-1dbf-49cb-93a5-e30f1622d303

Copilot finished work on behalf of marcoscaceres April 27, 2026 08:54

Copilot started work on behalf of marcoscaceres April 27, 2026 09:02 View session

Changes before error encountered

465f76a

Agent-Logs-Url: https://github.com/speced/respec-web-services/sessions/fd5e571e-1895-44ad-89f4-bd8ebec18f41

Copilot started work on behalf of marcoscaceres April 27, 2026 14:54 View session

Copilot finished work on behalf of marcoscaceres April 27, 2026 15:00

Merge branch 'main' into fix/caniuse-web-features

af222f9

marcoscaceres marked this pull request as ready for review April 27, 2026 19:37

marcoscaceres requested a review from sidvishnoi May 4, 2026 11:17

sidvishnoi reviewed May 4, 2026

View reviewed changes

Comment thread routes/caniuse/index.ts

Copilot started work on behalf of marcoscaceres May 5, 2026 04:18 View session

Copilot finished work on behalf of marcoscaceres May 5, 2026 04:29

Copilot started work on behalf of marcoscaceres May 5, 2026 13:03 View session

Merge origin/main into fix/caniuse-web-features

48c7ce6

Resolves conflict in routes/caniuse/feature.ts: keep JSON 500 error response (our improvement) over the old text/plain response from main. Co-authored-by: marcoscaceres <870154+marcoscaceres@users.noreply.github.com>

Copilot finished work on behalf of marcoscaceres May 5, 2026 13:08

Conversation

marcoscaceres commented Apr 25, 2026

Summary

Uh oh!

Uh oh!

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Reviewed changes

Uh oh!

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Uh oh!

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Uh oh!

Uh oh!

Uh oh!

Copilot AI commented Apr 27, 2026

Uh oh!

marcoscaceres commented Apr 27, 2026

Uh oh!

marcoscaceres commented Apr 27, 2026

Uh oh!

Copilot AI commented Apr 27, 2026

Uh oh!

Uh oh!

marcoscaceres commented May 5, 2026

Uh oh!

Copilot AI commented May 5, 2026

Uh oh!

marcoscaceres commented May 5, 2026

Uh oh!

Copilot AI commented May 5, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

5 participants