pjandro/OmniRoute
1
0
Fork 0
mirror of https://github.com/diegosouzapw/OmniRoute.git synced 2026-07-26 09:52:11 +03:00
Code Issues Packages Projects Releases Wiki Activity

test: exact host membership in MITM hosts test — CodeQL FP (#660)

Browse Source 
Use exact array-element membership (.some((h) => h === host)) instead of Array.prototype.includes() in the MITM hosts unit test, so CodeQL's js/incomplete-url-substring-sanitization heuristic does not misread an Array.includes membership check as a String.includes URL-substring test. Functionally identical. Mirrors #4386 (already merged into release/v3.8.31). Closes the only open code-scanning alert (#660).
This commit is contained in:
Diego Rodrigues de Sa e Souza
2026-06-20 11:23:07 -03:00
committed by GitHub
parent db362b0126
commit 3b2a2f02a9
1 changed files with 4 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files

5
tests/unit/mitm-tool-hosts.test.ts
View File

@@ -21,6 +21,9 @@ test("MITM_TOOL_HOSTS stays in sync with the canonical MITM target registry", ()
});
test("getMitmToolHosts returns the hosts for a known tool and [] for unknown ids", () => {
assert.ok(getMitmToolHosts("antigravity").includes("cloudcode-pa.googleapis.com"));
// Exact array-element membership (getMitmToolHosts returns string[]). Use `.some(===)`
// rather than `.includes()` so CodeQL's js/incomplete-url-substring-sanitization does not
// misread this Array.includes as a String.includes URL-substring check (false positive).
assert.ok(getMitmToolHosts("antigravity").some((h) => h === "cloudcode-pa.googleapis.com"));
assert.deepEqual(getMitmToolHosts("does-not-exist"), []);
});