From 28b21c7d05cbaf15e2e7c1ff5941ad44f831c4aa Mon Sep 17 00:00:00 2001 From: darshanime Date: Tue, 14 Jul 2026 18:25:02 +0530 Subject: [PATCH] use mkdtempSync --- dist/index.js | 10 +++++++--- src/warpbuild/mirror-cache.ts | 10 +++++++--- 2 files changed, 14 insertions(+), 6 deletions(-) diff --git a/dist/index.js b/dist/index.js index 49a5c0d..5c58625 100644 --- a/dist/index.js +++ b/dist/index.js @@ -42335,10 +42335,14 @@ async function httpPut(url, file) { throw new Error(`PUT answered ${res.status}`); } } +// Bundles live in a private mkdtemp'd dir (0700) — a co-tenant can't pre-empt a write via a +// planted symlink, and mkdtempSync is the primitive CodeQL accepts (js/insecure-temporary-file). +let mirrorTmpDir; function tempBundlePath(tag) { - // Unpredictable name so a bundle write can't be pre-empted by a symlink planted on a - // shared tmpdir. - return external_path_namespaceObject.join(external_os_namespaceObject.tmpdir(), `wb-${tag}-${external_crypto_namespaceObject.randomBytes(12).toString('hex')}.bundle`); + if (!mirrorTmpDir) { + mirrorTmpDir = external_fs_namespaceObject.mkdtempSync(external_path_namespaceObject.join(external_os_namespaceObject.tmpdir(), 'wb-mirror-')); + } + return external_path_namespaceObject.join(mirrorTmpDir, `wb-${tag}-${external_crypto_namespaceObject.randomBytes(12).toString('hex')}.bundle`); } // Kept for callers/tests: reset .git/objects to the empty `git init` shape. async function resetGitObjects(gitDir) { diff --git a/src/warpbuild/mirror-cache.ts b/src/warpbuild/mirror-cache.ts index fdb9308..8d2953b 100644 --- a/src/warpbuild/mirror-cache.ts +++ b/src/warpbuild/mirror-cache.ts @@ -591,11 +591,15 @@ async function httpPut(url: string, file: string): Promise { } } +// Bundles live in a private mkdtemp'd dir (0700) — a co-tenant can't pre-empt a write via a +// planted symlink, and mkdtempSync is the primitive CodeQL accepts (js/insecure-temporary-file). +let mirrorTmpDir: string | undefined function tempBundlePath(tag: string): string { - // Unpredictable name so a bundle write can't be pre-empted by a symlink planted on a - // shared tmpdir. + if (!mirrorTmpDir) { + mirrorTmpDir = fs.mkdtempSync(path.join(os.tmpdir(), 'wb-mirror-')) + } return path.join( - os.tmpdir(), + mirrorTmpDir, `wb-${tag}-${crypto.randomBytes(12).toString('hex')}.bundle` ) }