Clear the four CodeQL alerts in the release scripts (replaceAll for %2F, comment-line check)
维护者通常 1 天内回复
还没有人认领这个 Issue。
评估
- 难度
- 2/5
- 预计耗时
- 1-3 小时
- 新手友好度
- 83/100
- Issue 类型
- 缺陷
- 描述清晰度
- 描述清楚
- 活跃度
- 活跃
- 技术栈
- github, typescript
调研方向
先查看 scripts/npm-publish-guard.mjs、scripts/release-notes.mjs 和 scripts/release-notes.test.mjs，然后运行 npm run test:scripts。按照 issue 中的说明更新三处斜杠替换和生成的注释检查；现有脚本测试通过，并且 PR 的 CodeQL 运行将四条警报都标记为已修复，即表示完成。
由索引模型根据 Issue 内容生成。
描述
Problem
Four CodeQL alerts are open on main, all in release tooling. None is exploitable, but they keep the code-scanning page non-empty, and a dismissed pattern is flagged again wherever it is copied.
| Alert | Rule | Location (v2/main) |
Flagged | Why it is not a vulnerability |
|---|---|---|---|---|
| #37 | js/incomplete-sanitization |
scripts/npm-publish-guard.mjs:45 (packageUrl) |
name.replace("/", "%2F") replaces only the first / |
npm names hold at most one / (@scope/name); inputs are this repo's own manifests; the URL is a read-only registry lookup |
| #38 | js/incomplete-sanitization |
scripts/release-notes.mjs:229 (registryUrl) |
same | same |
| #39 | js/incomplete-sanitization |
scripts/release-notes.test.mjs:465 (fake fetch) |
same | test code mirroring the above |
| #36 | js/bad-tag-filter |
scripts/release-notes.mjs:299 |
/^<!--.*-->$/ does not match a multi-line comment |
not a sanitizer: it skips GitHub's one-line <!-- Release notes generated… --> marker while parsing GitHub's own generated notes line by line; an unexpected line aborts with "unrecognized line" rather than passing through |
Expected
One PR, no behavior change:
.replace("/", "%2F")→.replaceAll("/", "%2F")in all three places.- The comment check at
release-notes.mjs:299→line.startsWith("<!--") && line.endsWith("-->"). - The existing tests in
scripts/*.test.mjspass unchanged (npm run test:scripts); add a case only if a branch loses coverage. - After the PR's CodeQL run, the four alerts show as fixed on the PR, and close on
mainat the next milestone merge.
Notes
- Found while closing out v2.1.0 (#5243). The two CORS alerts from that release (#42, #43) were dismissed as false positives; #40 and #41 closed as fixed when v2.1.0 replaced
origin: "*". - No changeset: the scripts are not part of any published package.
- 主要语言
- TypeScript
- 星标
- 91.4k
- 派生
- 11.8k
- 平均合并
- 6 小时 39 分钟
- 30 天内合并 PR
- 146
环境准备
- 没有 Dockerfile 或 Docker Compose 文件
- 有 Pull Request 模板
- 阅读贡献指南
从这里开始
- 先读完整个 Issue，再读项目的贡献指南。
- 在 Issue 下留言说明你要接手 —— 这能避免两个人做同样的事。
- Fork 仓库，在一个分支上完成修改。
- 提交 Pull Request，并在描述里引用这个 Issue 编号。
modelcontextprotocol/servers 的其他 Issue
-
docs(git): clarify unconfined default scope and repository confinement options in README and CLI未关闭
难度 2/5 1-3 小时 新手友好度 73/100
modelcontextprotocol/servers#5231 · 1 条评论 ·
维护者通常 1 天内回复
-
docs(git): clarify unconfined default scope and repository confinement options in README and CLI未关闭
难度 1/5 1 小时以内 新手友好度 74/100
modelcontextprotocol/servers#5230 ·
维护者通常 1 天内回复
-
git: README should state plainly that without --repository every reachable repository is in scope未关闭documentation server-git v2
难度 1/5 1-3 小时 新手友好度 84/100
modelcontextprotocol/servers#5225 · 1 条评论 ·
维护者通常 1 天内回复
-
chore v2
难度 2/5 1-3 小时 新手友好度 82/100
modelcontextprotocol/servers#5223 ·
维护者通常 1 天内回复
-
bug v2
难度 2/5 1-3 小时 新手友好度 76/100
modelcontextprotocol/servers#5217 ·
维护者通常 1 天内回复
查看 modelcontextprotocol/servers 的全部 Issue
相似的 Issue
-
难度 1/5 1 小时以内 新手友好度 70/100
microsoft/playwright#43640 ·
维护者通常 1 天内回复
-
bug
难度 2/5 1-3 小时 新手友好度 82/100
grasshopper-protocol/grsshppr#172 ·
维护者通常 1 天内回复
-
bug help wanted
难度 2/5 1-3 小时 新手友好度 78/100
Tencent/teamai-cli#1397 ·
维护者通常 1 天内回复
-
难度 2/5 1-3 小时 新手友好度 70/100
DouyinFE/semi-design#3641 ·
维护者通常 3 天内回复
-
bug
难度 2/5 1-3 小时 新手友好度 83/100
维护者通常 1 天内回复