Skip to content

[code-scanning-fix] Fix js/http-to-file-access: use correct CodeQL suppression syntax #56500

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
pelikhan merged 1 commit into from
Aug 28, 2026
Merged

[code-scanning-fix] Fix js/http-to-file-access: use correct CodeQL suppression syntax #56500

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
Fix code scanning alert #654: use CodeQL suppression syntax 
The lgtm[rule-id] suppression comment syntax is from the deprecated
LGTM.com service and is not recognized by GitHub's native CodeQL
alert-suppression mechanism, which uses codeql[rule-id]. This left
the js/http-to-file-access alert open despite the file already
performing full validation (content-type, size limit, PDF signature
check) of the downloaded bytes before writing them to disk.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
  • Loading branch information
@github-actions
github-actions[bot] and Copilot authored Aug 28, 2026
commit 2395688502a7eef11bd8891106adbed2ae311ec1
12 changes: 6 additions & 6 deletions scripts/ensure-docs-slide-pdf.js
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -189,12 +189,12 @@ async function readPdfBytes() {
async function main() {
const pdfBytes = await readPdfBytes();
fs.mkdirSync(path.dirname(OUTPUT_PATH), { recursive: true });
// readPdfBytes() only ever returns bytes from a fixed, hardcoded GitHub media
// URL (constructed from validated repo/ref values) after checking the response
// content-type, enforcing a size limit, and verifying the PDF file signature —
// or a locally generated placeholder PDF. Neither path writes arbitrary/unvalidated
// network data to disk.
fs.writeFileSync(OUTPUT_PATH, pdfBytes); // lgtm[js/http-to-file-access]
// codeql[js/http-to-file-access]: readPdfBytes() only ever returns bytes from a
// fixed, hardcoded GitHub media URL (constructed from validated repo/ref values)
// after checking the response content-type, enforcing a size limit, and
// verifying the PDF file signature — or a locally generated placeholder PDF.
// Neither path writes arbitrary/unvalidated network data to disk.
fs.writeFileSync(OUTPUT_PATH, pdfBytes);

@github-actions github-actions Bot Aug 28, 2026

Copy link
Copy Markdown
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

[/diagnosing-bugs] The // codeql[js/http-to-file-access] annotation is now placed 5 lines above the flagged writeFileSync statement. GitHub CodeQL suppression requires the annotation to appear on the same line as the flagged statement (or, for some configurations, the immediately preceding line). With several intervening comment lines, the scanner may not associate the token with the write call, leaving alert #654 still open — the exact problem this PR aims to fix.

💡 Suggested fix — annotation inline with the statement 
  // readPdfBytes() only ever returns bytes from a fixed, hardcoded GitHub media
  // URL (constructed from validated repo/ref values) after checking the response
  // content-type, enforcing a size limit, and verifying the PDF file signature —
  // or a locally generated placeholder PDF. Neither path writes arbitrary/unvalidated
  // network data to disk.
  fs.writeFileSync(OUTPUT_PATH, pdfBytes); // codeql[js/http-to-file-access]

This keeps the full justification comment while placing the suppression token exactly where CodeQL expects it — on the same line as the flagged statement, matching the GitHub CodeQL suppression docs.

@copilot please address this.

Comment on lines +192 to +197
console.log(`✓ Slide PDF ready at ${OUTPUT_PATH}`);
}

Expand Down
Loading