False positive - Incomplete string escaping
- Lingua principale
- CodeQL
- Stelle
- 10.1k
- Fork
- 2.1k
- Merge medio
- 2g 15h
- PR unite (30g)
- 141
Descrizione
**Description of the false positive**
```
Incomplete string escaping or encoding
This does not escape backslash characters in the input.
```
```ts
part = `"${part.replace(/"/g, '\\"')}"`;
```
This is intentional,
actual string: `abc\"` -> `"abc\\""`
JS:
```js
'abc\\"' '"abc\\\\""'
```
This code is used in a client library to serialize caller input as-is from list to header value.
```ts
const input = ["a", "b", `\\"`];
const serialized = `a,b,"\\\\""`;
```
**Code samples or links to source code**
https://github.com/smithy-lang/smithy-typescript/blob/d8446cfa3bf6cbcf1187d1ad744ac5a296e442d7/packages/smithy-client/src/quote-header.ts#L8
Guida per i contributori
Apri la guida per i contributori
Direzione di ricerca
Start with the linked packages/smithy-client/src/quote-header.ts example and inspect the CodeQL finding that flags its string escaping. Reproduce the report with the provided inputs, then identify the relevant query coverage; done means intentional backslashes in this serialization are no longer reported as incomplete escaping.
Scritto dal modello di indicizzazione a partire dal testo della issue.
Valutazione
- Stack tecnologico
- typescript
- Ambito
- security
- Tipo di issue
- Bug
- Difficoltà
- 3/5
- Tempo stimato
- 1-2 giorni
- Stato di attività
- Ferma
- Chiarezza
- Abbastanza chiara
- Idoneità per principianti
- 35/100