CodeQL: Incomplete string escaping or encoding @ lib/readfiles.js:13 about node-readfiles HOT 8 CLOSED

Hmm odd ok I'll take a look

from node-readfiles.

Hi @guatedude2, thanks for refactoring the library. We compared function buildFilter between the old file readfiles.js and the new refactored file build-filter.ts, but the RegExp and the sanitizing untrusted input - which is what CodeQL was reporting about - are the same. So although the syntax is new, the semantics are the same. Was the CodeQL finding a false positive afterall?

from node-readfiles.

I see. I think this might be CodeQL miss-interpreting my actions. I've updated the regex to escape backslashes. It seems there would be issues with not escaping them. Let me know if that addresses the issue with CodeQL.

from node-readfiles.

Hi @guatedude2
Did you get a chance to look at this and the similar issue #9 ?
Curious about your thoughts or if this is in need of a fix.

from node-readfiles.

Hey so sorry I did not let me try looking into it tonight

from node-readfiles.

@IamGreut Refactored library to TypeScript can you try now

from node-readfiles.

Let me know if this worked. If it doesn't i'll reopen this issue

from node-readfiles.

@guatedude2 just to clarify - we are more interested in whether or not the 2 alerts brought up by CodeQL (this one and issue #9) are valid based on the intentions of the code.
If they do not seem to be relevant, then there is probably no alteration or fix needed to the code as it is.

To @ThibaudLopez's point, since we did not detect any change in the actual readfiles.js we do not have much reason to believe that if the problem was true that anything has actually been fixed.
As you are the original author and authority on this, we are looking for your thoughts on it so that it may help us identify what, if anything, needs to be fixed from our use of this library in our own code.

Thank you so much for your attention and work you've done already.

from node-readfiles.