robojerk/codeql-action

Fix backslashes being accepted by sanitizeArtifactName

Browse source
This commit is contained in:
Michael B. Gale 2025-06-04 12:27:55 +01:00
parent 7fd62151d9
commit 1eab40885f
No known key found for this signature in database
GPG key ID: FF5E2765BD00628F
6 changed files with 9 additions and 4 deletions
Download patch file Download diff file Expand all files Collapse all files

4
src/debug-artifacts.test.ts
View file

@ -18,6 +18,10 @@ test("sanitizeArtifactName", (t) => {
debugArtifacts.sanitizeArtifactName("*m)a&n^y%i££n+v!a:l[i]d"),
"manyinvalid",
);
t.deepEqual(
debugArtifacts.sanitizeArtifactName("\\foo\\bar//baz"),
"foobarbaz",
);
});
// These next tests check the correctness of the logic to determine whether or not

2
src/debug-artifacts.ts
View file

@ -28,7 +28,7 @@ import {
} from "./util";
export function sanitizeArtifactName(name: string): string {
return name.replace(/[^a-zA-Z0-9_\\-]+/g, "");
return name.replace(/[^a-zA-Z0-9_-]+/g, "");
}
/**