fix: resolve CodeQL alerts — http-to-file-access and log-injection by sametcelikbicak · Pull Request #78 · sametcelikbicak/rolecraft

sametcelikbicak · 2026-07-09T21:08:53Z

Closes CodeQL alerts #54, #55, #56, #57, #58

fix: resolve CodeQL audit findings and improve test hygiene #54 js/http-to-file-access: Replaced runHttpsGet + createWriteStream with fetch() + arrayBuffer() + writeFile() in downloadFile. URL host whitelist (registry.npmjs.org) retained.
fix: use mkdtempSync for npm temp dir (CodeQL insecure-temporary-file) #55-fix: preserve GPG signature when release-prep moves tag to changelog commit #58 js/log-injection: Changed console.error template literals to use printf-style formatting with error message as separate argument, preventing injection through format string.
Updated test mock to capture all console.error arguments.

-    })
-  })
+  const buffer = Buffer.from(await response.arrayBuffer())
+  await writeFile(dest, buffer)


fix: resolve CodeQL alerts — http-to-file-access and log-injection

f5c6ddf

github-advanced-security AI found potential problems Jul 9, 2026

View reviewed changes

Comment thread src/utils/resolver.js

})

})

const buffer = Buffer.from(await response.arrayBuffer())

await writeFile(dest, buffer)

sametcelikbicak merged commit 26db1f2 into main Jul 9, 2026
3 checks passed

sametcelikbicak deleted the fix/codeql-alerts branch July 9, 2026 21:10

Provide feedback