robojerk/codeql-action

Sanitize artifact name before using

Browse source
This commit is contained in:
Edoardo Pirovano 2021-11-05 08:31:07 +00:00
parent ea169430d2
commit f360da772a
No known key found for this signature in database
GPG key ID: 047556B5D93FFE28
9 changed files with 30 additions and 6 deletions
Download patch file Download diff file Expand all files Collapse all files

10
src/actions-util.test.ts
View file

@ -680,3 +680,13 @@ test("isAnalyzingDefaultBranch()", async (t) => {
t.deepEqual(await actionsutil.isAnalyzingDefaultBranch(), false);
});
});
test("sanitizeArifactName", (t) => {
t.deepEqual(actionsutil.sanitizeArifactName("hello-world_"), "hello-world_");
t.deepEqual(actionsutil.sanitizeArifactName("hello`world`"), "helloworld");
t.deepEqual(actionsutil.sanitizeArifactName("hello===123"), "hello123");
t.deepEqual(
actionsutil.sanitizeArifactName("*m)a&n^y%i££n+v!a:l[i]d"),
"manyinvalid"
);
});

4
src/actions-util.ts
View file

@ -709,3 +709,7 @@ export async function isAnalyzingDefaultBranch(): Promise<boolean> {
return currentRef === defaultBranch;
}
export function sanitizeArifactName(name: string): string {
return name.replace(/[^a-zA-Z0-9_\\-]+/g, "");
}

2
src/analyze-action.ts
View file

@ -244,7 +244,7 @@ async function uploadDebugArtifacts(toUpload: string[], rootDir: string) {
suffix += `-${entry[1]}`;
}
await artifact.create().uploadArtifact(
`${DEBUG_ARTIFACT_NAME}${suffix}`,
actionsUtil.sanitizeArifactName(`${DEBUG_ARTIFACT_NAME}${suffix}`),
toUpload.map((file) => path.normalize(file)),
path.normalize(rootDir)
);