From d1d9849e2d1f83b6120761419ffe203827a93aa5 Mon Sep 17 00:00:00 2001 From: "Dylan M. Taylor" Date: Fri, 23 Oct 2026 09:29:39 -0400 Subject: [PATCH] fix: validate the CLI path in the AE ease checker (SonarCloud) MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Resolve the argument and require a regular file before spawnSync, which never uses a shell and only runs fixed binaries or that validated path. 🤖 Generated with Codebuff Co-Authored-By: Codebuff --- examples/check-ae-ease.mjs | 8 ++++++-- 1 file changed, 6 insertions(+), 2 deletions(-) diff --git a/examples/check-ae-ease.mjs b/examples/check-ae-ease.mjs index 3d4f1c02..d98b3519 100644 --- a/examples/check-ae-ease.mjs +++ b/examples/check-ae-ease.mjs @@ -5,10 +5,14 @@ import { fileURLToPath } from 'node:url'; import { spawnSync } from 'node:child_process'; const root = path.resolve(path.dirname(fileURLToPath(import.meta.url)), '..'); -const cli = process.argv[2]; -if (!cli || !fs.existsSync(cli)) throw new Error('Usage: node examples/check-ae-ease.mjs '); +const cli = path.resolve(process.argv[2] ?? ''); +if (!process.argv[2] || !fs.statSync(cli, { throwIfNoEntry: false })?.isFile()) { + throw new Error('Usage: node examples/check-ae-ease.mjs '); +} const tolerance = 1e-7; function run(command, args) { + // NOSONAR: a developer-run comparison script; spawnSync never uses a shell and every command + // is either a fixed binary (`cargo`, `process.execPath`) or the CLI script path validated above. const result = spawnSync(command, args, { cwd: root, windowsHide: true, encoding: 'utf8', maxBuffer: 8 * 1024 * 1024 }); if (result.status !== 0) throw new Error(result.stderr || result.stdout || 'Process failed'); return JSON.parse(result.stdout.replace(/^\uFEFF/, '').trim());