actions / actions/toolkit

`@actions/core`: codeql found `js/file-system-race` issue

Open
#2,170 0 comments 0 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

bug
Dominant language
TypeScript
Stars
5.9k
Forks
1.8k
PR merge metrics
No merged PRs in 30d

Description

Describe the bug

There is a js/file-system-race issue found in file-command.ts file.

To Reproduce

Steps to reproduce the behavior:

$ cd packages/core
$ codeql database create .db-codeql-main --language=typescript --build-mode=none
$ codeql database analyze .db-codeql-main javascript-security-extended.qls --format=sarifv2.1.0 --output=codeql-main.sarif
$ jq '[.runs[].results[]] | length' codeql-main.sarif
1 # <-- amount of found issues
$ jq -r '.runs[].results[] | "\(.ruleId): \(.locations[].physicalLocation.artifactLocation.uri)"' codeql-main.sarif
js/file-system-race: src/file-command.ts # issue id and file name where it was found

Expected behavior

js/file-system-race should not be reported.

Screenshots
Here is the screenshot from https://microsoft.github.io/sarif-web-component/ with the uploaded resulting SARIF file:

Image

Contributor guide

Open the contributing guide

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Research direction

Start in packages/core/src/file-command.ts at line 22, then run the CodeQL commands from the issue to reproduce the js/file-system-race result. Review the reported SARIF location and determine a change that removes the finding without breaking the file-command behavior. Done means the CodeQL analysis reports zero issues for this case.

Written by the indexing model from the issue text.

Assessment

Tech stack
typescript
Domain
security, tooling
Issue type
Bug
Difficulty
3/5
Estimated time
1-2 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
45/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.