The stat is the validation that rejects anything but an existing regular
file; annotate it with that reasoning.
🤖 Generated with Codebuff
Co-Authored-By: Codebuff <noreply@codebuff.com>
The path is the developer's own CLI build, stat'ed as a regular file before
use; suppress the taint finding with that reasoning.
🤖 Generated with Codebuff
Co-Authored-By: Codebuff <noreply@codebuff.com>
Sonar applies NOSONAR to the line that carries the marker, so the
explanation above the call did not suppress anything.
🤖 Generated with Codebuff
Co-Authored-By: Codebuff <noreply@codebuff.com>
Resolve the argument and require a regular file before spawnSync, which
never uses a shell and only runs fixed binaries or that validated path.
🤖 Generated with Codebuff
Co-Authored-By: Codebuff <noreply@codebuff.com>