Potential fix for code scanning alert no. 10: String length conflation

[tianjianjiang]

User description

Potential fix for https://github.com/openvanilla/McBopomofo/security/code-scanning/10

To fix the problem, ensure that all offsets and lengths passed to NSRange (such as in NSMakeRange) are expressed in UTF-16 code units as expected by NSString and Cocoa APIs. Specifically, instead of using composingBuffer.count, use the length of the corresponding NSString, i.e. NSString(string: composingBuffer).length.
File/region to change:

• File: Source/InputMethodController.swift
• Line(s): 724
  Update the selectionRange: NSMakeRange(composingBuffer.count, 0) to use the NSString length instead.
  No new methods or complex imports are required; NSString is available via Foundation/Cocoa.

---

Suggested fixes powered by Copilot Autofix. Review carefully before merging.

---

PR Type

Bug fix

---

Description

• Fix UTF-16 length for NSRange

• Prevent string length conflation issue

• Align selectionRange with Cocoa expectations

---

Diagram Walkthrough

flowchart LR
  str["Swift String length (characters)"]
  utf16["NSString length (UTF-16 units)"]
  nsrange["NSRange for setMarkedText"]
  apis["Cocoa Text APIs"]

  str -- "was used (incorrect)" --> nsrange
  utf16 -- "now used (correct)" --> nsrange
  nsrange -- "compatible with" --> apis

Loading

File Walkthrough

	Relevant files
Bug fix	InputMethodController.swift Use NSString length for NSRange in setMarkedText                  Source/InputMethodController.swift Replace character count with NSString length. Build NSRange using UTF-16 code units. Update setMarkedText selectionRange argument. +1/-1

---

[github-actions]

Persistent review updated to latest commit a211050

[lukhnos]

Let's take the Copilot's suggestion, i.e. replace composingBuffer.count with composingBuffer.utf16.count, which is the correct idiomatic fix here.

[Copilot]

Pull request overview

Copilot reviewed 1 out of 1 changed files in this pull request and generated no new comments.

[lukhnos]

LGTM. Thanks!