From 2be8c385839ca4e02e475474a04ddae8dc35d222 Mon Sep 17 00:00:00 2001 From: Bob Brown Date: Thu, 28 Dec 2023 19:22:13 -0800 Subject: [PATCH 1/2] Fixing CodeQL bugs --- Extension/.vscode/settings.json | 4 +- .../src/Debugger/configurationProvider.ts | 10 ++--- Extension/src/Debugger/configurations.ts | 38 +++++++++---------- Extension/src/Debugger/utils.ts | 2 +- .../src/LanguageServer/configurations.ts | 2 +- Extension/src/LanguageServer/settings.ts | 3 +- Extension/src/Utility/Text/taggedLiteral.ts | 2 +- Extension/ui/settings.ts | 2 +- 8 files changed, 32 insertions(+), 31 deletions(-) diff --git a/Extension/.vscode/settings.json b/Extension/.vscode/settings.json index ed0b05384..969f4c40d 100644 --- a/Extension/.vscode/settings.json +++ b/Extension/.vscode/settings.json @@ -41,8 +41,8 @@ "editor.formatOnSave": true, "files.insertFinalNewline": true, "editor.codeActionsOnSave": { - "source.fixAll.eslint": true, - "source.organizeImports": true + "source.fixAll.eslint": "explicit", + "source.organizeImports": "explicit" }, }, "eslint.format.enable": true, diff --git a/Extension/src/Debugger/configurationProvider.ts b/Extension/src/Debugger/configurationProvider.ts index ab329b60c..21f719db9 100644 --- a/Extension/src/Debugger/configurationProvider.ts +++ b/Extension/src/Debugger/configurationProvider.ts @@ -1162,16 +1162,16 @@ abstract class DefaultConfigurationProvider implements IConfigurationAssetProvid class WindowsConfigurationProvider extends DefaultConfigurationProvider { private executable: string = "a.exe"; - private pipeProgram: string = "<" + localize("path.to.pipe.program", "full path to pipe program such as {0}", "plink.exe").replace(/\"/g, "\\\"") + ">"; + private pipeProgram: string = "<" + localize("path.to.pipe.program", "full path to pipe program such as {0}", "plink.exe").replace(/"/g, '\\"') + ">"; private MIMode: string = 'gdb'; private setupCommandsBlock: string = `"setupCommands": [ { - "description": "${localize("enable.pretty.printing", "Enable pretty-printing for {0}", "gdb").replace(/\"/g, "\\\"")}", + "description": "${localize("enable.pretty.printing", "Enable pretty-printing for {0}", "gdb").replace(/"/g, '\\"')}", "text": "-enable-pretty-printing", "ignoreFailures": true }, { - "description": "${localize("enable.intel.disassembly.flavor", "Set Disassembly Flavor to {0}", "Intel").replace(/\"/g, "\\\"")}", + "description": "${localize("enable.intel.disassembly.flavor", "Set Disassembly Flavor to {0}", "Intel").replace(/"/g, '\\"')}", "text": "-gdb-set disassembly-flavor intel", "ignoreFailures": true } @@ -1205,12 +1205,12 @@ class LinuxConfigurationProvider extends DefaultConfigurationProvider { private MIMode: string = 'gdb'; private setupCommandsBlock: string = `"setupCommands": [ { - "description": "${localize("enable.pretty.printing", "Enable pretty-printing for {0}", "gdb").replace(/\"/g, "\\\"")}", + "description": "${localize("enable.pretty.printing", "Enable pretty-printing for {0}", "gdb").replace(/"/g, '\\"')}", "text": "-enable-pretty-printing", "ignoreFailures": true }, { - "description": "${localize("enable.intel.disassembly.flavor", "Set Disassembly Flavor to {0}", "Intel").replace(/\"/g, "\\\"")}", + "description": "${localize("enable.intel.disassembly.flavor", "Set Disassembly Flavor to {0}", "Intel").replace(/"/g, '\\"')}", "text": "-gdb-set disassembly-flavor intel", "ignoreFailures": true } diff --git a/Extension/src/Debugger/configurations.ts b/Extension/src/Debugger/configurations.ts index 08a1c3411..a4730814d 100644 --- a/Extension/src/Debugger/configurations.ts +++ b/Extension/src/Debugger/configurations.ts @@ -92,7 +92,7 @@ function createLaunchString(name: string, type: string, executable: string): str return `"name": "${name}", "type": "${type}", "request": "launch", -"program": "${localize("enter.program.name", "enter program name, for example {0}", "$\{workspaceFolder\}" + "/" + executable).replace(/\"/g, "\\\"")}", +"program": "${localize("enter.program.name", "enter program name, for example {0}", "$\{workspaceFolder\}" + "/" + executable).replace(/"/g, '\\"')}", "args": [], "stopAtEntry": false, "cwd": "$\{fileDirname\}", @@ -106,7 +106,7 @@ function createAttachString(name: string, type: string, executable: string): str "name": "${name}", "type": "${type}", "request": "attach",{0} -`, [type === "cppdbg" ? `${os.EOL}"program": "${localize("enter.program.name", "enter program name, for example {0}", "$\{workspaceFolder\}" + "/" + executable).replace(/\"/g, "\\\"")}",` : ""]); +`, [type === "cppdbg" ? `${os.EOL}"program": "${localize("enter.program.name", "enter program name, for example {0}", "$\{workspaceFolder\}" + "/" + executable).replace(/"/g, '\\"')}",` : ""]); } function createRemoteAttachString(name: string, type: string, executable: string): string { @@ -114,7 +114,7 @@ function createRemoteAttachString(name: string, type: string, executable: string "name": "${name}", "type": "${type}", "request": "attach", -"program": "${localize("enter.program.name", "enter program name, for example {0}", "$\{workspaceFolder\}" + "/" + executable).replace(/\"/g, "\\\"")}", +"program": "${localize("enter.program.name", "enter program name, for example {0}", "$\{workspaceFolder\}" + "/" + executable).replace(/"/g, '\\"')}", "processId": "$\{command:pickRemoteProcess\}" `; } @@ -158,7 +158,7 @@ abstract class Configuration implements IConfiguration { export class MIConfigurations extends Configuration { public GetLaunchConfiguration(): IConfigurationSnippet { - const name: string = `(${this.MIMode}) ${localize("launch.string", "Launch").replace(/\"/g, "\\\"")}`; + const name: string = `(${this.MIMode}) ${localize("launch.string", "Launch").replace(/"/g, '\\"')}`; const body: string = formatString(`{ \t${indentJsonString(createLaunchString(name, this.miDebugger, this.executable))}, @@ -168,7 +168,7 @@ export class MIConfigurations extends Configuration { return { "label": configPrefix + name, - "description": localize("launch.with", "Launch with {0}.", this.MIMode).replace(/\"/g, "\\\""), + "description": localize("launch.with", "Launch with {0}.", this.MIMode).replace(/"/g, '\\"'), "bodyText": body.trim(), "isInitialConfiguration": true, "debuggerType": DebuggerType.cppdbg @@ -176,7 +176,7 @@ export class MIConfigurations extends Configuration { } public GetAttachConfiguration(): IConfigurationSnippet { - const name: string = `(${this.MIMode}) ${localize("attach.string", "Attach").replace(/\"/g, "\\\"")}`; + const name: string = `(${this.MIMode}) ${localize("attach.string", "Attach").replace(/"/g, '\\"')}`; const body: string = formatString(`{ \t${indentJsonString(createAttachString(name, this.miDebugger, this.executable))} @@ -186,7 +186,7 @@ export class MIConfigurations extends Configuration { return { "label": configPrefix + name, - "description": localize("attach.with", "Attach with {0}.", this.MIMode).replace(/\"/g, "\\\""), + "description": localize("attach.with", "Attach with {0}.", this.MIMode).replace(/"/g, '\\"'), "bodyText": body.trim(), "debuggerType": DebuggerType.cppdbg }; @@ -197,7 +197,7 @@ export class MIConfigurations extends Configuration { export class PipeTransportConfigurations extends Configuration { public GetLaunchConfiguration(): IConfigurationSnippet { - const name: string = `(${this.MIMode}) ${localize("pipe.launch", "Pipe Launch").replace(/\"/g, "\\\"")}`; + const name: string = `(${this.MIMode}) ${localize("pipe.launch", "Pipe Launch").replace(/"/g, '\\"')}`; const body: string = formatString(` { @@ -208,7 +208,7 @@ export class PipeTransportConfigurations extends Configuration { return { "label": configPrefix + name, - "description": localize("pipe.launch.with", "Pipe Launch with {0}.", this.MIMode).replace(/\"/g, "\\\""), + "description": localize("pipe.launch.with", "Pipe Launch with {0}.", this.MIMode).replace(/"/g, '\\"'), "bodyText": body.trim(), "debuggerType": DebuggerType.cppdbg }; @@ -216,7 +216,7 @@ export class PipeTransportConfigurations extends Configuration { } public GetAttachConfiguration(): IConfigurationSnippet { - const name: string = `(${this.MIMode}) ${localize("pipe.attach", "Pipe Attach").replace(/\"/g, "\\\"")}`; + const name: string = `(${this.MIMode}) ${localize("pipe.attach", "Pipe Attach").replace(/"/g, '\\"')}`; const body: string = formatString(` { @@ -226,7 +226,7 @@ export class PipeTransportConfigurations extends Configuration { }`, [this.additionalProperties ? `,${os.EOL}\t${indentJsonString(this.additionalProperties)}` : ""]); return { "label": configPrefix + name, - "description": localize("pipe.attach.with", "Pipe Attach with {0}.", this.MIMode).replace(/\"/g, "\\\""), + "description": localize("pipe.attach.with", "Pipe Attach with {0}.", this.MIMode).replace(/"/g, '\\"'), "bodyText": body.trim(), "debuggerType": DebuggerType.cppdbg }; @@ -237,7 +237,7 @@ export class PipeTransportConfigurations extends Configuration { export class WindowsConfigurations extends Configuration { public GetLaunchConfiguration(): IConfigurationSnippet { - const name: string = `(Windows) ${localize("launch.string", "Launch").replace(/\"/g, "\\\"")}`; + const name: string = `(Windows) ${localize("launch.string", "Launch").replace(/"/g, '\\"')}`; const body: string = ` { @@ -246,7 +246,7 @@ export class WindowsConfigurations extends Configuration { return { "label": configPrefix + name, - "description": localize("launch.with.vs.debugger", "Launch with the Visual Studio C/C++ debugger.").replace(/\"/g, "\\\""), + "description": localize("launch.with.vs.debugger", "Launch with the Visual Studio C/C++ debugger.").replace(/"/g, '\\"'), "bodyText": body.trim(), "isInitialConfiguration": true, "debuggerType": DebuggerType.cppvsdbg @@ -255,7 +255,7 @@ export class WindowsConfigurations extends Configuration { } public GetAttachConfiguration(): IConfigurationSnippet { - const name: string = `(Windows) ${localize("attach.string", "Attach").replace(/\"/g, "\\\"")}`; + const name: string = `(Windows) ${localize("attach.string", "Attach").replace(/"/g, '\\"')}`; const body: string = ` { @@ -264,7 +264,7 @@ export class WindowsConfigurations extends Configuration { return { "label": configPrefix + name, - "description": localize("attach.with.vs.debugger", "Attach to a process with the Visual Studio C/C++ debugger.").replace(/\"/g, "\\\""), + "description": localize("attach.with.vs.debugger", "Attach to a process with the Visual Studio C/C++ debugger.").replace(/"/g, '\\"'), "bodyText": body.trim(), "debuggerType": DebuggerType.cppvsdbg }; @@ -277,7 +277,7 @@ export class WSLConfigurations extends Configuration { public bashPipeProgram = process.arch === 'ia32' ? "${env:windir}\\\\sysnative\\\\bash.exe" : "${env:windir}\\\\system32\\\\bash.exe"; public GetLaunchConfiguration(): IConfigurationSnippet { - const name: string = `(${this.MIMode}) ${localize("bash.on.windows.launch", "Bash on Windows Launch").replace(/\"/g, "\\\"")}`; + const name: string = `(${this.MIMode}) ${localize("bash.on.windows.launch", "Bash on Windows Launch").replace(/"/g, '\\"')}`; const body: string = formatString(` { @@ -287,14 +287,14 @@ export class WSLConfigurations extends Configuration { return { "label": configPrefix + name, - "description": localize("launch.bash.windows", "Launch in Bash on Windows using {0}.", this.MIMode).replace(/\"/g, "\\\""), + "description": localize("launch.bash.windows", "Launch in Bash on Windows using {0}.", this.MIMode).replace(/"/g, '\\"'), "bodyText": body.trim(), "debuggerType": DebuggerType.cppdbg }; } public GetAttachConfiguration(): IConfigurationSnippet { - const name: string = `(${this.MIMode}) ${localize("bash.on.windows.attach", "Bash on Windows Attach").replace(/\"/g, "\\\"")}`; + const name: string = `(${this.MIMode}) ${localize("bash.on.windows.attach", "Bash on Windows Attach").replace(/"/g, '\\"')}`; const body: string = formatString(` { @@ -304,7 +304,7 @@ export class WSLConfigurations extends Configuration { return { "label": configPrefix + name, - "description": localize("remote.attach.bash.windows", "Attach to a remote process running in Bash on Windows using {0}.", this.MIMode).replace(/\"/g, "\\\""), + "description": localize("remote.attach.bash.windows", "Attach to a remote process running in Bash on Windows using {0}.", this.MIMode).replace(/"/g, '\\"'), "bodyText": body.trim(), "debuggerType": DebuggerType.cppdbg }; diff --git a/Extension/src/Debugger/utils.ts b/Extension/src/Debugger/utils.ts index 173a62761..e0bbc9217 100644 --- a/Extension/src/Debugger/utils.ts +++ b/Extension/src/Debugger/utils.ts @@ -12,7 +12,7 @@ export class ArchitectureReplacer { public static checkAndReplaceWSLPipeProgram(pipeProgramStr: string, expectedArch: ArchType): string | undefined { let replacedPipeProgram: string | undefined; const winDir: string | undefined = process.env.WINDIR ? process.env.WINDIR.toLowerCase() : undefined; - const winDirAltDirSep: string | undefined = process.env.WINDIR ? process.env.WINDIR.replace('\\', '/').toLowerCase() : undefined; + const winDirAltDirSep: string | undefined = process.env.WINDIR ? process.env.WINDIR.replace(/\\/g, '/').toLowerCase() : undefined; const winDirEnv: string = "${env:windir}"; if (winDir && winDirAltDirSep && (pipeProgramStr.indexOf(winDir) === 0 || pipeProgramStr.indexOf(winDirAltDirSep) === 0 || pipeProgramStr.indexOf(winDirEnv) === 0)) { diff --git a/Extension/src/LanguageServer/configurations.ts b/Extension/src/LanguageServer/configurations.ts index e1d992051..dd9e25d2f 100644 --- a/Extension/src/LanguageServer/configurations.ts +++ b/Extension/src/LanguageServer/configurations.ts @@ -1993,7 +1993,7 @@ export class CppProperties { // Escape the path string for literal use in a regular expression // Need to escape any quotes to match the original text - let escapedPath: string = curPath.replace(/\"/g, '\\\"'); + let escapedPath: string = curPath.replace(/"/g, '\\"'); escapedPath = escapedPath.replace(/[-\"\/\\^$*+?.()|[\]{}]/g, '\\$&'); // Create a pattern to search for the path with either a quote or semicolon immediately before and after, diff --git a/Extension/src/LanguageServer/settings.ts b/Extension/src/LanguageServer/settings.ts index a083e14d8..cfb0dc75a 100644 --- a/Extension/src/LanguageServer/settings.ts +++ b/Extension/src/LanguageServer/settings.ts @@ -10,6 +10,7 @@ import * as fs from 'fs'; import * as os from 'os'; import * as path from 'path'; import * as semver from 'semver'; +import { quote } from 'shell-quote'; import * as vscode from 'vscode'; import * as nls from 'vscode-nls'; import * as which from 'which'; @@ -278,7 +279,7 @@ export class CppSettings extends Settings { let clangVersion: string; try { const exePath: string = getExtensionFilePath(`./LLVM/bin/${clangName}`); - const output: string[] = execSync(`${exePath} --version`).toString().split(" "); + const output: string[] = execSync(`${quote([exePath])} --version`).toString().split(" "); if (output.length < 3 || output[0] !== clangStr || output[1] !== "version" || !semver.valid(output[2])) { if (output.length === 3) { return path; diff --git a/Extension/src/Utility/Text/taggedLiteral.ts b/Extension/src/Utility/Text/taggedLiteral.ts index 494df5320..4fe0d51a1 100644 --- a/Extension/src/Utility/Text/taggedLiteral.ts +++ b/Extension/src/Utility/Text/taggedLiteral.ts @@ -12,7 +12,7 @@ import { isIdentifierPart, isIdentifierStart } from './characterCodes'; /** simple dynamic tagged literal implementation */ export function taggedLiteral(templateString: string, templateVars: Record): string { - return safeEval(`\`${templateString.replace('\\', '\\\\').replace(/`/, '\`')}\`;`, templateVars) as string; + return safeEval(`\`${templateString.replace(/\\/g, '\\\\').replace(/`/g, '\`')}\`;`, templateVars) as string; } function parseTaggedLiteral(templateString: string) { diff --git a/Extension/ui/settings.ts b/Extension/ui/settings.ts index f64fd84e2..036a7d19a 100644 --- a/Extension/ui/settings.ts +++ b/Extension/ui/settings.ts @@ -321,7 +321,7 @@ class SettingsApp { private showErrorWithInfo(elementID: string, errorInfo: string): void { this.showElement(elementID, errorInfo ? true : false); // eslint-disable-next-line @typescript-eslint/no-non-null-assertion - document.getElementById(elementID)!.innerHTML = errorInfo ? errorInfo : ""; + document.getElementById(elementID)!.textContent = errorInfo ? errorInfo : ""; } private updateConfigSelection(message: any): void { From 5ffea493510784aa50d00b98d5333677568e8e6f Mon Sep 17 00:00:00 2001 From: Bob Brown Date: Fri, 5 Jan 2024 14:23:18 -0800 Subject: [PATCH 2/2] revise usage of `quote` --- Extension/src/LanguageServer/settings.ts | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/Extension/src/LanguageServer/settings.ts b/Extension/src/LanguageServer/settings.ts index cfb0dc75a..c5c096f39 100644 --- a/Extension/src/LanguageServer/settings.ts +++ b/Extension/src/LanguageServer/settings.ts @@ -279,7 +279,7 @@ export class CppSettings extends Settings { let clangVersion: string; try { const exePath: string = getExtensionFilePath(`./LLVM/bin/${clangName}`); - const output: string[] = execSync(`${quote([exePath])} --version`).toString().split(" "); + const output: string[] = execSync(quote([exePath, '--version'])).toString().split(" "); if (output.length < 3 || output[0] !== clangStr || output[1] !== "version" || !semver.valid(output[2])) { if (output.length === 3) { return path;