From e73c940c9bfd79008a4b792d6fb46a19273cb59a Mon Sep 17 00:00:00 2001 From: Henry Mercer Date: Tue, 28 Apr 2026 11:33:48 +0100 Subject: [PATCH] Defensively sanitize timestamp --- lib/analyze-action.js | 7 +++++-- lib/init-action-post.js | 7 +++++-- lib/init-action.js | 7 +++++-- lib/setup-codeql-action.js | 7 +++++-- lib/upload-lib.js | 7 +++++-- lib/upload-sarif-action.js | 7 +++++-- src/diagnostics.ts | 9 +++++++-- 7 files changed, 37 insertions(+), 14 deletions(-) diff --git a/lib/analyze-action.js b/lib/analyze-action.js index 020c41d20..72da44c72 100644 --- a/lib/analyze-action.js +++ b/lib/analyze-action.js @@ -107893,10 +107893,13 @@ function writeDiagnostic(config, language, diagnostic) { try { (0, import_fs.mkdirSync)(diagnosticsPath, { recursive: true }); const uniqueSuffix = Math.floor(Math.random() * 4294967296).toString(16).padStart(8, "0"); + const sanitizedTimestamp = diagnostic.timestamp.replace( + /[^a-zA-Z0-9.-]/g, + "" + ); const jsonPath = import_path.default.resolve( diagnosticsPath, - // Remove colons from the timestamp as these are not allowed in Windows filenames. - `codeql-action-${diagnostic.timestamp.replaceAll(":", "")}-${uniqueSuffix}.json` + `codeql-action-${sanitizedTimestamp}-${uniqueSuffix}.json` ); (0, import_fs.writeFileSync)(jsonPath, JSON.stringify(diagnostic)); } catch (err) { diff --git a/lib/init-action-post.js b/lib/init-action-post.js index e401797e9..9a8363372 100644 --- a/lib/init-action-post.js +++ b/lib/init-action-post.js @@ -165812,10 +165812,13 @@ function writeDiagnostic(config, language, diagnostic) { try { (0, import_fs.mkdirSync)(diagnosticsPath, { recursive: true }); const uniqueSuffix = Math.floor(Math.random() * 4294967296).toString(16).padStart(8, "0"); + const sanitizedTimestamp = diagnostic.timestamp.replace( + /[^a-zA-Z0-9.-]/g, + "" + ); const jsonPath = import_path.default.resolve( diagnosticsPath, - // Remove colons from the timestamp as these are not allowed in Windows filenames. - `codeql-action-${diagnostic.timestamp.replaceAll(":", "")}-${uniqueSuffix}.json` + `codeql-action-${sanitizedTimestamp}-${uniqueSuffix}.json` ); (0, import_fs.writeFileSync)(jsonPath, JSON.stringify(diagnostic)); } catch (err) { diff --git a/lib/init-action.js b/lib/init-action.js index 977240f21..3e779fe79 100644 --- a/lib/init-action.js +++ b/lib/init-action.js @@ -105398,10 +105398,13 @@ function writeDiagnostic(config, language, diagnostic) { try { (0, import_fs.mkdirSync)(diagnosticsPath, { recursive: true }); const uniqueSuffix = Math.floor(Math.random() * 4294967296).toString(16).padStart(8, "0"); + const sanitizedTimestamp = diagnostic.timestamp.replace( + /[^a-zA-Z0-9.-]/g, + "" + ); const jsonPath = import_path.default.resolve( diagnosticsPath, - // Remove colons from the timestamp as these are not allowed in Windows filenames. - `codeql-action-${diagnostic.timestamp.replaceAll(":", "")}-${uniqueSuffix}.json` + `codeql-action-${sanitizedTimestamp}-${uniqueSuffix}.json` ); (0, import_fs.writeFileSync)(jsonPath, JSON.stringify(diagnostic)); } catch (err) { diff --git a/lib/setup-codeql-action.js b/lib/setup-codeql-action.js index 48a206e8a..0c492ed45 100644 --- a/lib/setup-codeql-action.js +++ b/lib/setup-codeql-action.js @@ -105468,10 +105468,13 @@ function writeDiagnostic(config, language, diagnostic) { try { (0, import_fs.mkdirSync)(diagnosticsPath, { recursive: true }); const uniqueSuffix = Math.floor(Math.random() * 4294967296).toString(16).padStart(8, "0"); + const sanitizedTimestamp = diagnostic.timestamp.replace( + /[^a-zA-Z0-9.-]/g, + "" + ); const jsonPath = import_path.default.resolve( diagnosticsPath, - // Remove colons from the timestamp as these are not allowed in Windows filenames. - `codeql-action-${diagnostic.timestamp.replaceAll(":", "")}-${uniqueSuffix}.json` + `codeql-action-${sanitizedTimestamp}-${uniqueSuffix}.json` ); (0, import_fs.writeFileSync)(jsonPath, JSON.stringify(diagnostic)); } catch (err) { diff --git a/lib/upload-lib.js b/lib/upload-lib.js index faca0370a..c34c46ec7 100644 --- a/lib/upload-lib.js +++ b/lib/upload-lib.js @@ -107503,10 +107503,13 @@ function writeDiagnostic(config, language, diagnostic) { try { (0, import_fs.mkdirSync)(diagnosticsPath, { recursive: true }); const uniqueSuffix = Math.floor(Math.random() * 4294967296).toString(16).padStart(8, "0"); + const sanitizedTimestamp = diagnostic.timestamp.replace( + /[^a-zA-Z0-9.-]/g, + "" + ); const jsonPath = import_path.default.resolve( diagnosticsPath, - // Remove colons from the timestamp as these are not allowed in Windows filenames. - `codeql-action-${diagnostic.timestamp.replaceAll(":", "")}-${uniqueSuffix}.json` + `codeql-action-${sanitizedTimestamp}-${uniqueSuffix}.json` ); (0, import_fs.writeFileSync)(jsonPath, JSON.stringify(diagnostic)); } catch (err) { diff --git a/lib/upload-sarif-action.js b/lib/upload-sarif-action.js index d412f3547..e4b8dbde7 100644 --- a/lib/upload-sarif-action.js +++ b/lib/upload-sarif-action.js @@ -108259,10 +108259,13 @@ function writeDiagnostic(config, language, diagnostic) { try { (0, import_fs.mkdirSync)(diagnosticsPath, { recursive: true }); const uniqueSuffix = Math.floor(Math.random() * 4294967296).toString(16).padStart(8, "0"); + const sanitizedTimestamp = diagnostic.timestamp.replace( + /[^a-zA-Z0-9.-]/g, + "" + ); const jsonPath = import_path.default.resolve( diagnosticsPath, - // Remove colons from the timestamp as these are not allowed in Windows filenames. - `codeql-action-${diagnostic.timestamp.replaceAll(":", "")}-${uniqueSuffix}.json` + `codeql-action-${sanitizedTimestamp}-${uniqueSuffix}.json` ); (0, import_fs.writeFileSync)(jsonPath, JSON.stringify(diagnostic)); } catch (err) { diff --git a/src/diagnostics.ts b/src/diagnostics.ts index 6b1911d05..ab9ca4a7a 100644 --- a/src/diagnostics.ts +++ b/src/diagnostics.ts @@ -173,10 +173,15 @@ function writeDiagnostic( const uniqueSuffix = Math.floor(Math.random() * 0x100000000) .toString(16) .padStart(8, "0"); + // We should only need to remove colons, but to be defensive, only allow a restricted set of + // characters. + const sanitizedTimestamp = diagnostic.timestamp.replace( + /[^a-zA-Z0-9.-]/g, + "", + ); const jsonPath = path.resolve( diagnosticsPath, - // Remove colons from the timestamp as these are not allowed in Windows filenames. - `codeql-action-${diagnostic.timestamp.replaceAll(":", "")}-${uniqueSuffix}.json`, + `codeql-action-${sanitizedTimestamp}-${uniqueSuffix}.json`, ); writeFileSync(jsonPath, JSON.stringify(diagnostic));