From 051c380bb8e1acce3c3d95fd65788263ba788e0d Mon Sep 17 00:00:00 2001 From: "Dylan M. Taylor" Date: Wed, 21 Oct 2026 17:31:31 -0400 Subject: [PATCH] revert: drop check-ae-ease.mjs hardening (SonarCloud taint false positive) The argv->spawnSync/fs flow in this local dev example is flagged as S8707/S8705 regardless of validation (SonarCloud can't recognize the CLI trust boundary), and the attempted fix fails the new_security_rating gate. Reverting to keep the PR green; the finding will be marked Won't Fix (dev tool, developer-supplied arg). --- examples/check-ae-ease.mjs | 6 ++---- 1 file changed, 2 insertions(+), 4 deletions(-) diff --git a/examples/check-ae-ease.mjs b/examples/check-ae-ease.mjs index 6f9f84289..3d4f1c02c 100644 --- a/examples/check-ae-ease.mjs +++ b/examples/check-ae-ease.mjs @@ -5,10 +5,8 @@ import { fileURLToPath } from 'node:url'; import { spawnSync } from 'node:child_process'; const root = path.resolve(path.dirname(fileURLToPath(import.meta.url)), '..'); -const cliArg = process.argv[2]; -if (!cliArg) throw new Error('Usage: node examples/check-ae-ease.mjs '); -const cli = path.resolve(cliArg); -if (!fs.existsSync(cli) || !fs.statSync(cli).isFile() || !cli.endsWith('.js')) throw new Error('Expected an existing .js CLI file: ' + cliArg); +const cli = process.argv[2]; +if (!cli || !fs.existsSync(cli)) throw new Error('Usage: node examples/check-ae-ease.mjs '); const tolerance = 1e-7; function run(command, args) { const result = spawnSync(command, args, { cwd: root, windowsHide: true, encoding: 'utf8', maxBuffer: 8 * 1024 * 1024 });