toolkit icon indicating copy to clipboard operation
toolkit copied to clipboard

`@actions/core`: codeql found `js/file-system-race` issue

Open fabasoad opened this issue 5 months ago • 0 comments

Describe the bug

There is a js/file-system-race issue found in file-command.ts file.

To Reproduce

Steps to reproduce the behavior:

$ cd packages/core
$ codeql database create .db-codeql-main --language=typescript --build-mode=none
$ codeql database analyze .db-codeql-main javascript-security-extended.qls --format=sarifv2.1.0 --output=codeql-main.sarif
$ jq '[.runs[].results[]] | length' codeql-main.sarif
1 # <-- amount of found issues
$ jq -r '.runs[].results[] | "\(.ruleId): \(.locations[].physicalLocation.artifactLocation.uri)"' codeql-main.sarif
js/file-system-race: src/file-command.ts # issue id and file name where it was found

Expected behavior

js/file-system-race should not be reported.

Screenshots Here is the screenshot from https://microsoft.github.io/sarif-web-component/ with the uploaded resulting SARIF file:

Image

fabasoad avatar Oct 29 '25 14:10 fabasoad