James Feng
|
76c47956dd
|
fix: resolve ~50 CodeQL alerts — unused, injection, type issues
unused-local-variable / useless-assignment (~30 alerts):
- mcp-client: manager.ts (11), connection.ts (3)
- acp-link: server.ts (4), rcs-upstream.ts
- remote-control-server: 10 files (SessionDetail, acp/client, transports, etc.)
- src: constants/tools.ts, attribution.ts, win32.ts, main.tsx, attachments.ts
log-injection (2):
- chromeNativeHost.ts, rcs-upstream.ts — apply sanitizeLog()
indirect-command-line-injection (4):
- imagePaste.ts: convert shell:true to explicit sh -c pattern
use-before-declaration (4):
- query.ts, claude.ts, tools.ts, attachments.ts — move feature() import up
comparison-between-incompatible-types (2):
- ExitPlanModePermissionRequest.tsx, useTerminalNotification.ts
shared: sensitive.ts — sanitizeLog() helper
|
2026-06-08 17:15:22 +08:00 |
|
James Feng
|
2249f184ba
|
fix: resolve 17 CodeQL alerts — log injection, command injection, ReDoS
- acp/client.ts: add _sanitize helper with CR/LF escaping to prevent
js/log-injection in 20 console.log/error calls (15 flagged alerts)
- execFileNoThrowPortable.ts: remove redundant env:process.env from
execaSync (already inherited by default) — fixes js/indirect-command-line-injection
- toolCalls.ts: replace ambiguous regex [\w.-]* with non-backtracking
[\w-]*(\.[\w-]*)+ and add 255-char length guard — fixes js/polynomial-redos
Validation: bun run check:fix ✓, bunx tsc --noEmit (0 new errors) ✓,
bun run build ✓
|
2026-06-08 10:10:29 +08:00 |
|