Anso 86bfc108ae fix(security): resolve open CodeQL path-injection and temp-file alerts (#1322) ...

Re-establish the path-containment barrier inline at the backup readdir
sink in restoreStackFiles. The sink previously built backupDir through
the getBackupDir helper, whose stack-name validation the static analyzer
does not trace, leaving a flagged path-injection sink. The barrier now
resolves backupDir against its root and asserts containment inline, the
same pattern already used in backupStackFiles. Behavior is unchanged for
valid stack names (already validated one line above by resolveStackDir).

Scope the js/insecure-temporary-file rule out of e2e/** in the CodeQL
config. End-to-end fixtures must seed files into the backend's COMPOSE_DIR
so the API under test can read them back; that path is a fixed location
under /tmp in both CI and local dev, which the rule flags. A randomized
temp directory does not apply because the backend resolves against its own
COMPOSE_DIR. Production code is still analyzed.

2026-06-05 23:02:08 -04:00

..

extensions

fix: add CodeQL barrier model for sanitizeForLog against log injection (#935)

2026-05-06 08:47:34 -04:00

codeql-config.yml

fix(security): resolve open CodeQL path-injection and temp-file alerts (#1322)

2026-06-05 23:02:08 -04:00