Repository navigation
Clear the four CodeQL alerts in the release scripts (replaceAll for %2F, comment-line check) #5261
Description
Problem
Four CodeQL alerts are open on main, all in release tooling. None is exploitable, but they keep the code-scanning page non-empty, and a dismissed pattern is flagged again wherever it is copied.
| Alert | Rule | Location (v2/main) |
Flagged | Why it is not a vulnerability |
|---|---|---|---|---|
| #37 | js/incomplete-sanitization |
scripts/npm-publish-guard.mjs:45 (packageUrl) |
name.replace("/", "%2F") replaces only the first / |
npm names hold at most one / (@scope/name); inputs are this repo's own manifests; the URL is a read-only registry lookup |
| #38 | js/incomplete-sanitization |
scripts/release-notes.mjs:229 (registryUrl) |
same | same |
| #39 | js/incomplete-sanitization |
scripts/release-notes.test.mjs:465 (fake fetch) |
same | test code mirroring the above |
| #36 | js/bad-tag-filter |
scripts/release-notes.mjs:299 |
/^<!--.*-->$/ does not match a multi-line comment |
not a sanitizer: it skips GitHub's one-line <!-- Release notes generated… --> marker while parsing GitHub's own generated notes line by line; an unexpected line aborts with "unrecognized line" rather than passing through |
Expected
One PR, no behavior change:
.replace("/", "%2F")→.replaceAll("/", "%2F")in all three places.- The comment check at
release-notes.mjs:299→line.startsWith("<!--") && line.endsWith("-->"). - The existing tests in
scripts/*.test.mjspass unchanged (npm run test:scripts); add a case only if a branch loses coverage. - After the PR's CodeQL run, the four alerts show as fixed on the PR, and close on
mainat the next milestone merge.
Notes
- Found while closing out v2.1.0 (Release v2.1.0 #5243). The two CORS alerts from that release ([Claude App] "Could not attach to MCP server github" #42, Initial GitLab server version #43) were dismissed as false positives; MCP servers fail to connect with
npxon Windows #40 and Need AWS S3 MCP Server #41 closed as fixed when v2.1.0 replacedorigin: "*". - No changeset: the scripts are not part of any published package.
Activity