Aman-Mittal opened a new pull request, #172: URL: https://github.com/apache/fineract-backoffice-ui/pull/172
CodeQL flagged four regular-expression injections in codemod-signals.mjs (alerts #11-#14). Field names arrive from process.argv and were interpolated straight into the patterns that find declarations, assignments, reads and template references — so a name carrying regex metacharacters changed what those patterns *meant* rather than what they matched. A `.` would match any character and rewrite the wrong field; an unbalanced `(` would throw. Two layers. Field names must now be JavaScript identifiers, which is what they always are and which no metacharacter can satisfy, and they are escaped at each interpolation regardless — the guard is the fix, the escaping keeps it true if someone later feeds these patterns from somewhere else. audit-async-state.mjs builds a pattern the same way. Its names come from AST identifiers so it was never reachable, but it is the same shape and one line to harden. Verified: the codemod still produces identical output on a scratch component (declaration, assignments, reads and both template references), and `codemod-signals.mjs file 'a.*'` is now rejected rather than silently corrupting the file. -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
