fix: detected calls to child_process from a function... in...

[orbisai0security]

Summary

Fix high severity security issue in scripts/find-unused-diganostic-messages.mjs.

Vulnerability

Field	Value
ID	javascript.lang.security.detect-child-process.detect-child-process
Severity	HIGH
Scanner	semgrep
Rule	javascript.lang.security.detect-child-process.detect-child-process
File	scripts/find-unused-diganostic-messages.mjs:18

Description: Detected calls to child_process from a function argument line. This could lead to a command injection if the input is user controllable. Try to avoid calls to child_process, and if it is needed ensure user input is correctly sanitized or sandboxed.

Changes

• scripts/find-unused-diganostic-messages.mjs

Verification

• Build passes
• Scanner re-scan confirms fix
• LLM code review passed

---

Automated security fix by OrbisAI Security

[typescript-bot]

This PR doesn't have any linked issues. Please open an issue that references this PR. From there we can discuss and prioritise.

[typescript-bot]

This PR doesn't have any linked issues. Please open an issue that references this PR. From there we can discuss and prioritise.

[Copilot]

Copilot was unable to review this pull request because the user who requested the review has reached their quota limit.

[jakebailey]

This is really not a security problem. These strings are guaranteed to be valid identifiers, and are just known strings in the repo. Also, you probably didn't test locally, as the file has not been formatted properly and uses the wrong line endings.

Is this a bot account? Are you able to reply to commentary? How did you determine this was something that needed fixing?

[ritschwumm]

why does this change each and every line of ‎scripts/find-unused-diganostic-messages.mjs ?
maybe the line endings were switched from LF to CRLF or the other way round? if so - why?