The AI-written code warned about GraphQL metacharacters in interpolated values but still concatenated them, enabling GraphQL injection.

@@ -63,7 +64,16 @@ export function gql(strings: TemplateStringsArray, ...values: unknown[]): string   for (let i = 0; i < strings.length; i++) {     result += strings[i];     if (i < values.length) {-      result += String(values[i]);+      const val = String(values[i]);+      // M-8: Warn if interpolated values contain GraphQL metacharacters+      if (/[{}():]/.test(val)) {+        if (typeof console !== 'undefined') {+          console.warn(+            '[SpecifyJS] gql: Interpolated value contains GraphQL metacharacters. Use variables parameter instead of string interpolation to prevent injection.',+          );+        }+      }+      result += val;     }   }   return result.replace(/\s+/g, ' ').trim();@@ -79,6 +89,7 @@ export function gql(strings: TemplateStringsArray, ...values: unknown[]): string export function createGraphQLClient(config: GraphQLClientConfig): GraphQLClient {   const { url, headers: configHeaders, credentials, cache: cacheEnabled = false } = config; +  const MAX_CACHE_SIZE = 100;   const responseCache = new Map<string, GraphQLResponse<unknown>>();    function buildCacheKey(query: string, variables?: Record<string, unknown>): string {@@ -96,6 +107,7 @@ export function createGraphQLClient(config: GraphQLClientConfig): GraphQLClient      const body = JSON.stringify({ query, variables }); +    assertSecureUrl(url);     const response = await fetch(url, {       method: 'POST',       headers: reqHeaders,@@ -128,6 +140,10 @@ export function createGraphQLClient(config: GraphQLClientConfig): GraphQLClient           return cached as GraphQLResponse<T>;         }         const result = await execute<T>(query, variables);+        if (responseCache.size >= MAX_CACHE_SIZE) {+          const oldest = responseCache.keys().next().value;+          if (oldest !== undefined) responseCache.delete(oldest);+        }         responseCache.set(key, result);         return result;       }

       html += ` style="${renderStyle(value as Record<string, string | number>)}"`;     } else if (key === 'value' || key === 'checked' || key === 'selected') {@@ -276,11 +279,16 @@ function renderStyle(style: Record<string, string | number>): string {      // Convert camelCase to kebab-case     const cssProp = prop.replace(/[A-Z]/g, (m) => `-${m.toLowerCase()}`);-    const cssValue =+    let cssValue =       typeof value === 'number' && value !== 0 && !isUnitlessProp(prop)         ? `${value}px`         : String(value); +    // L-6: Sanitize CSS values — strip dangerous patterns+    cssValue = cssValue+      .replace(/expression\s*\(/gi, '')+      .replace(/url\s*\(\s*javascript:/gi, 'url(');+     parts.push(`${cssProp}:${cssValue}`);   }   return parts.join(';');

+    );+  }+   // Relative URLs are always allowed   if (url.startsWith('/') || url.startsWith('./') || url.startsWith('../')) {     return;

-          console.warn(-            '[SpecifyJS] gql: Interpolated value contains GraphQL metacharacters. Use variables parameter instead of string interpolation to prevent injection.',-          );-        }+        throw new Error(+          `[SpecifyJS] gql: Interpolated value "${val}" contains GraphQL metacharacters ({, }, (, ), :). ` ++            'Use the variables parameter instead of string interpolation to prevent injection.',+        );       }       result += val;     }

+    // L-6: Reject CSS values containing dangerous patterns.+    // Normalize unicode escapes and strip CSS comments before checking+    // to prevent bypass via \65xpression( or exp/**/ression( patterns.+    const normalizedCss = cssValue+      .replace(/\\[0-9a-fA-F]{1,6}\s?/g, '_')+      .replace(/\/\*[\s\S]*?\*\//g, '');+    if (/expression\s*\(|javascript\s*:|behavior\s*:|moz-binding|-o-link/i.test(normalizedCss)) {+      cssValue = '';+    }      parts.push(`${cssProp}:${cssValue}`);   }

+      throw new Error('[SpecifyJS] secureFetch: data: URI exceeds 1MB limit');+    }     return;   } -  // Parse absolute URLs+  // Parse absolute URLs — reject if unparseable   let parsed: URL;   try {     parsed = new URL(url, typeof window !== 'undefined' ? window.location.href : undefined);   } catch {-    /* v8 ignore next 2 -- URL parse failure is environment-specific; jsdom always provides a base */-    return;+    throw new Error(+      `[SpecifyJS] secureFetch: unable to validate URL "${url}". ` ++        `Provide a valid absolute HTTPS URL or a relative path.`,+    );   }    // Allow HTTPS@@ -49,8 +54,14 @@ export function assertSecureUrl(url: string): void {     return;   } -  // Allow localhost/127.0.0.1 for development (any protocol)-  if (parsed.hostname === 'localhost' || parsed.hostname === '127.0.0.1') {+  // Allow localhost for development (any protocol) — covers IPv4/IPv6 loopback+  if (+    parsed.hostname === 'localhost' ||+    parsed.hostname === '127.0.0.1' ||+    parsed.hostname === '[::1]' ||+    parsed.hostname === '0.0.0.0' ||+    parsed.hostname.startsWith('127.')+  ) {     return;   } @@ -70,5 +81,7 @@ export function assertSecureUrl(url: string): void { export function secureFetch(input: string | URL | Request, init?: RequestInit): Promise<Response> {   const url = typeof input === 'string' ? input : input instanceof URL ? input.href : input.url;   assertSecureUrl(url);-  return fetch(input, init);+  // Default to rejecting redirects to prevent redirect-based SSRF.+  // Callers can override with { redirect: 'follow' } if they trust the target.+  return fetch(input, { redirect: 'error', ...init }); }