sanitizeContext() sanitizes nothing: a string literal is passed to .replace() instead of a RegExp

Start with sanitizeContext in assets/js/files-list.js:311 and assets/js/media-modal.js:297, then inspect the new JS test suite associated with #1215. Verify callers do not depend on pass-through behavior, update both copies to use a RegExp, and add a unit test covering characters outside [a-z0-9_-].

Found while surveying the JS for #1215.

The bug

assets/js/files-list.js:311 and assets/js/media-modal.js:297 are identical:

sanitizeContext: function( context ) {
    context = context.replace( '/[^a-z0-9_-]/gi', '' ).toLowerCase();
    return context ? context : 'wp';
},

The first argument is a string literal, not a RegExp. String.prototype.replace with a string needle does exact-substring matching, so it looks for the literal text /[^a-z0-9_-]/gi and finds it never. The function strips nothing — it only lowercases.

Demonstrated:

The fix is to drop the quotes: context.replace( /[^a-z0-9_-]/gi, '' ).

Severity: low, and deliberately so

This is not exploitable. The context is re-sanitized server-side with sanitize_key() — see imagify_sanitize_context() in inc/functions/common.php:51, called at inc/classes/class-imagify-admin-ajax-post.php:1207. So the server never trusts the client value.

What this actually is: a dead defence-in-depth layer. It has been silently doing nothing, and anyone reading the code would reasonably assume the client sanitizes before sending.

Why it is worth fixing anyway

• It is two lines, in two files.
• It is exactly the class of bug #1215 exists to catch — parsing/sanitization that silently no-ops — so it makes a good first test case for the new JS suite.
• Removing the quotes changes what gets sent to the server for exotic context values. Worth a quick check that no caller relies on the current pass-through behaviour before merging.

Acceptance criteria

• Both copies use a real RegExp.
• A unit test asserts characters outside [a-z0-9_-] are stripped.
• Confirmed that no code path depends on the old no-op behaviour.

Notes

The two copies are byte-identical, as are the two sanitizeId implementations next to them (files-list.js:301, media-modal.js:287). Deduplicating them is a natural follow-up once #1215 gives the JS a module seam.