github/codeql-action
1
0
Fork 0
mirror of https://github.com/github/codeql-action.git synced 2026-11-10 23:05:27 +00:00
Code Issues Packages Projects Releases Wiki Activity

fix: decode SARIF location URIs in diff-informed alert filtering

Browse Source
This commit is contained in:
Sam Robson
2026-11-02 15:28:08 +00:00
parent 52cf185226
commit b05fe69863
4 changed files with 218 additions and 6 deletions
Download Patch File Download Diff File Expand all files Collapse all files

17
src/upload-lib.ts
View File

@@ -1099,9 +1099,21 @@ export function filterAlertsByDiffRange(
return locations.some((physicalLocation) => {
const locationUri = physicalLocation?.artifactLocation?.uri;
const locationStartLine = physicalLocation?.region?.startLine;
if (!locationUri || locationStartLine === undefined) {
if (
typeof locationUri !== "string" ||
!locationUri ||
locationStartLine === undefined
) {
return false;
}
let decodedLocationUri = locationUri;
try {
decodedLocationUri = decodeURIComponent(locationUri);
} catch {
logger.debug(
`Failed to decode location URI "${locationUri}", comparing it as a raw path`,
);
}
// Alert filtering here replicates the same behavior as the restrictAlertsTo
// extensible predicate in CodeQL. See the restrictAlertsTo documentation
// https://codeql.github.com/codeql-standard-libraries/csharp/codeql/util/AlertFiltering.qll/predicate.AlertFiltering$restrictAlertsTo.3.html
@@ -1109,7 +1121,8 @@ export function filterAlertsByDiffRange(
// of an alert location.
return diffRanges.some(
(range) =>
range.path === locationUri &&
(range.path === decodedLocationUri ||
range.path === locationUri) &&
((range.startLine <= locationStartLine &&
range.endLine >= locationStartLine) ||
(range.startLine === 0 && range.endLine === 0)),