Potential fix for code scanning alert no. 23: Overly permissive regular expression range

[dmetzner]

Potential fix for https://github.com/Catrobat/Catroweb/security/code-scanning/23

In general, to fix overly permissive character ranges, ensure that any - inside a character class either denotes a deliberate range (like A-Z) or is escaped or moved to an edge position so it’s treated as a literal hyphen. Also avoid mixed upper/lowercase ranges like A-f which unintentionally span more characters than expected.

Here, the suspicious part is [\w?=&./+-;#~%-]+. The +-; segment forms an unintended range from + to ;. The simplest fix that preserves existing functionality is to treat - as a literal by escaping it. Changing +-; to +\-; (i.e., .../+\-;#...) makes - a literal hyphen while keeping + and ; as separate allowed characters. No other changes to the pattern are necessary for this specific CodeQL issue. Concretely, in assets/Project/Project.js, within createLinks() on line 38, update the regex from /((http|https|ftp):\/\/[\w?=&./+-;#~%-]+(?![\w\s?&./;#~%"=-]*>))/g to /((http|https|ftp):\/\/[\w?=&./+\-;#~%-]+(?![\w\s?&./;#~%"=-]*>))/g. This does not change surrounding code or imports.

Suggested fixes powered by Copilot Autofix. Review carefully before merging.

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 49.97%. Comparing base (f2461a4) to head (4eb696c).
⚠️ Report is 15 commits behind head on develop.

Additional details and impacted files

@@              Coverage Diff              @@
##             develop    #6131      +/-   ##
=============================================
- Coverage      50.00%   49.97%   -0.04%     
  Complexity      7481     7481              
=============================================
  Files            722      722              
  Lines          24100    24100              
=============================================
- Hits           12051    12043       -8     
- Misses         12049    12057       +8     

Flag	Coverage Δ
behat	47.66% <ø> (-0.04%)	⬇️
phpunit	10.18% <ø> (ø)

Flags with carried forward coverage won't be shown. Click here to find out more.

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.