Repository navigation
Resolve five CodeQL warnings in test fixtures - #2
Merged
Merged
Conversation
![github-advanced-security[bot]](https://avatars.githubusercontent.com/in/57789?s=60&v=4){kind=small}
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
修正此前 CodeQL 在测试代码中的五条告警，保留现有测试行为与覆盖：
按用户要求，server/local-tls.cjs 及 TLS 文件竞争告警不变。版本继续为 0.4.1-preview，README 保留用户内容。
验证：本地语法、公开源码检查及新增 fixture 的语法检查通过；完整 npm test 为 258 项通过、0 失败、0 跳过。测试仅使用独立临时目录与模拟/演示通道；保持 Electron sandbox、contextIsolation 和 nodeIntegration 设置。只读独立代码复核未发现具体回归。提交后重新运行 Windows CI 和 CodeQL 确认告警状态。
重新扫描后对请求追踪做了进一步收敛：只写入固定路由分类，不保存原始请求 URL 或查询参数，避免引入 network-data-written-to-file 告警。相关两种挂件测试再次通过，并增加健康路由确实被记录的断言。
最终远端验证：提交 8628d41 的 CodeQL 所有语言分析通过，汇总为 No new alerts / 0 annotations；两次必需 verify 均通过，包含完整测试、构建与产物校验。CodeQL 自动将中途的两条请求追踪评审标为已解决。