Max Schaefer

Cannot access CodeQL environment variables in `database create --command`

4

I would like to explicitly invoke the JavaScript autobuilder as part of `codeql database create`, with the ultimate goal of passing it some custom options. However, even invoking it without...

Use execFile(Sync) instead of exec(Sync) in isExecutable(Sync).

3

This is arguably slightly tidier and perhaps safer, since the command isn't run through a shell.

Sanitize path components when constructing tool-cache path.

1

This ensures that the tool name, version number, and architecture each only correspond to a single path component, avoiding (accidental or malicious) path traversal and data corruption.