From 71f6890b2f3b191fa9d5bc8536b0beaa66fb6abb Mon Sep 17 00:00:00 2001 From: Gergo Magyar Date: Sun, 10 May 2026 15:38:37 +0100 Subject: [PATCH] fix(test): use mkdtempSync in http-route-extractor regression test Address CodeQL js/insecure-temporary-file warning on the new Windows- SIGSEGV regression test. The test was using path.join(tmpDir, "large-input") which, when nested inside a Date.now()-based parent tmpDir, lets CodeQL flag the directory as a predictable-name temp file with race-condition risk. Switch to fs.mkdtempSync(path.join(tmpDir, "large-input-")) so the suffix is a secure unique random string. --- gitnexus/test/unit/group/http-route-extractor.test.ts | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/gitnexus/test/unit/group/http-route-extractor.test.ts b/gitnexus/test/unit/group/http-route-extractor.test.ts index ea55098d2d..2e3b0d2120 100644 --- a/gitnexus/test/unit/group/http-route-extractor.test.ts +++ b/gitnexus/test/unit/group/http-route-extractor.test.ts @@ -840,7 +840,10 @@ export default r; const largeJava = `package com.example;\n\n@RestController\npublic class BigController {\n${padding}}\n`; expect(largeJava.length).toBeGreaterThan(40_000); - const dir = path.join(tmpDir, 'large-input'); + // Use mkdtempSync rather than a fixed subdir name: satisfies CodeQL's + // js/insecure-temporary-file rule by generating a unique random suffix + // instead of relying on the parent tmpDir's predictable Date.now() name. + const dir = fs.mkdtempSync(path.join(tmpDir, 'large-input-')); fs.mkdirSync(path.join(dir, 'src/controller'), { recursive: true }); fs.writeFileSync(path.join(dir, 'src/controller/BigController.java'), largeJava);