From a163573666e04c5d71413d42c5a73c87eedfe1ab Mon Sep 17 00:00:00 2001 From: Ashish Kumar Date: Fri, 16 Oct 2026 10:13:28 +0530 Subject: [PATCH] Clear the open code-scanning alerts Remove two unused test variables, and strip line breaks from logged auth failure reasons with an explicit replace that CodeQL recognises. The existing control-character replace already did this. --- src/server.ts | 3 ++- tests/scheduler.test.ts | 2 +- web/src/pages/standup/tabs.test.tsx | 2 +- 3 files changed, 4 insertions(+), 3 deletions(-) diff --git a/src/server.ts b/src/server.ts index 9dfc982..951ba67 100644 --- a/src/server.ts +++ b/src/server.ts @@ -73,7 +73,8 @@ const CHAT_EVENT_TYPES = new Set(['MESSAGE', 'ADDED_TO_SPACE', 'REMOVED_FROM_SPA /** Collapse control chars (incl. newlines) and cap length before logging untrusted text — prevents log forging. */ function logSafe(value: unknown): string { - return String(value).replace(/\p{Cc}/gu, ' ').slice(0, 200); + // CodeQL only recognises an explicit line-break replace as cleaning. + return String(value).replace(/[\r\n]/g, ' ').replace(/\p{Cc}/gu, ' ').slice(0, 200); } export function createServer(deps: ServerDeps): Express { diff --git a/tests/scheduler.test.ts b/tests/scheduler.test.ts index 3974e89..c58b0f5 100644 --- a/tests/scheduler.test.ts +++ b/tests/scheduler.test.ts @@ -137,7 +137,7 @@ describe('Scheduler', () => { it('prompts each participant at prompt time in their own timezone', async () => { const { repo, adapter, scheduler, clock } = await makeStack(); - const standup = await seedStandup(repo, { deadlineTime: '18:00' }); + await seedStandup(repo, { deadlineTime: '18:00' }); await repo.setTimezoneForUser('users/bob', 'Europe/London'); clock.set('2026-06-10T09:30'); diff --git a/web/src/pages/standup/tabs.test.tsx b/web/src/pages/standup/tabs.test.tsx index 7642d9d..c11aaf5 100644 --- a/web/src/pages/standup/tabs.test.tsx +++ b/web/src/pages/standup/tabs.test.tsx @@ -69,7 +69,7 @@ afterEach(() => vi.unstubAllGlobals()); describe('standup settings tab', () => { it('saves the schedule, questions and mood', async () => { - const { patches, calls } = server(); + const { patches } = server(); renderApp('/standups/1/settings'); const user = userEvent.setup(); expect(await screen.findByLabelText('Prompt time')).toHaveValue('09:30');