scriptoriumadmin/GitNexus
1
0
Fork 0
mirror of https://github.com/abhigyanpatwari/GitNexus.git synced 2026-10-29 06:32:28 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions 7

fix(test): use mkdtempSync in http-route-extractor regression test

Browse source 
Address CodeQL js/insecure-temporary-file warning on the new Windows-
SIGSEGV regression test. The test was using path.join(tmpDir, "large-input")
which, when nested inside a Date.now()-based parent tmpDir, lets CodeQL flag
the directory as a predictable-name temp file with race-condition risk.
Switch to fs.mkdtempSync(path.join(tmpDir, "large-input-")) so the suffix
is a secure unique random string.
This commit is contained in:
Gergo Magyar 2026-05-10 15:38:37 +01:00
parent 0ef71fd7df
commit 71f6890b2f
1 changed files with 4 additions and 1 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

5
gitnexus/test/unit/group/http-route-extractor.test.ts
View file

@ -840,7 +840,10 @@ export default r;
const largeJava = `package com.example;\n\n@RestController\npublic class BigController {\n${padding}}\n`;
expect(largeJava.length).toBeGreaterThan(40_000);
const dir = path.join(tmpDir, 'large-input');
// Use mkdtempSync rather than a fixed subdir name: satisfies CodeQL's
// js/insecure-temporary-file rule by generating a unique random suffix
// instead of relying on the parent tmpDir's predictable Date.now() name.
const dir = fs.mkdtempSync(path.join(tmpDir, 'large-input-'));
fs.mkdirSync(path.join(dir, 'src/controller'), { recursive: true });
fs.writeFileSync(path.join(dir, 'src/controller/BigController.java'), largeJava);