CodeQL: Incomplete string escaping or encoding @ lib/readfiles.js:13

[ThibaudLopez]

Hi @guatedude2, following #7 and #9, CodeQL reported another finding (see screenshot below):

• Title: Incomplete string escaping or encoding.
• Location: lib/readfiles.js:13
• Description: Sanitizing untrusted input is a common technique for preventing injection attacks such as SQL injection or cross-site scripting. Usually, this is done by escaping meta-characters such as quotes in a domain-specific way so that they are treated as normal characters.
• Tool: CodeQL
• Rule ID: js/incomplete-sanitization

You probably see the same on your CodeQL dashboard.

Is this a true positive or false positive?

Thanks

---

[guatedude2]

Hmm odd ok I'll take a look

[IamGreut]

Hi @guatedude2
Did you get a chance to look at this and the similar issue #9 ?
Curious about your thoughts or if this is in need of a fix.

[guatedude2]

Hey so sorry I did not let me try looking into it tonight

[guatedude2]

@IamGreut Refactored library to TypeScript can you try now

[guatedude2]

Let me know if this worked. If it doesn't i'll reopen this issue

[ThibaudLopez]

Hi @guatedude2, thanks for refactoring the library. We compared function buildFilter between the old file readfiles.js and the new refactored file build-filter.ts, but the RegExp and the sanitizing untrusted input - which is what CodeQL was reporting about - are the same. So although the syntax is new, the semantics are the same. Was the CodeQL finding a false positive afterall?

[IamGreut]

@guatedude2 just to clarify - we are more interested in whether or not the 2 alerts brought up by CodeQL (this one and issue #9) are valid based on the intentions of the code.
If they do not seem to be relevant, then there is probably no alteration or fix needed to the code as it is.

To @ThibaudLopez's point, since we did not detect any change in the actual readfiles.js we do not have much reason to believe that if the problem was true that anything has actually been fixed.
As you are the original author and authority on this, we are looking for your thoughts on it so that it may help us identify what, if anything, needs to be fixed from our use of this library in our own code.

Thank you so much for your attention and work you've done already.

[guatedude2]

I see. I think this might be CodeQL miss-interpreting my actions. I've updated the regex to escape backslashes. It seems there would be issues with not escaping them. Let me know if that addresses the issue with CodeQL.