Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Fix new CodeQL scanning warning #16518

Closed
timvandermeij opened this issue Jun 4, 2023 · 1 comment · Fixed by #16520
Closed

Fix new CodeQL scanning warning #16518

timvandermeij opened this issue Jun 4, 2023 · 1 comment · Fixed by #16520

Comments

@timvandermeij
Copy link
Contributor

timvandermeij commented Jun 4, 2023

There is currently one unresolved warning in https://github.com/mozilla/pdf.js/security/code-scanning/257. It's interesting because the line has been there for almost a year now as it was introduced in 0c420f5, but merging 74c62ea 4 days ago seems to have triggered the alert, possibly because of new CodeQL rules having been deployed in the meantime and because the code touched in that commit is very close to this line.

As far as I can tell this looks like a false positive given that the variable swap seems to work if I try this in isolation. If it's indeed a false positive we can simply dismiss the alert in the UI (and we should report it to CodeQL given that previous time we did that it actually got fixed upstream), but if there is actually a bug here we should fix it.

/cc @calixteman as the original author of this code

@timvandermeij timvandermeij changed the title Fix CodeQL scanning alert Fix new CodeQL scanning warning Jun 4, 2023
@Snuffleupagus
Copy link
Collaborator

It appears that all of the following is now dead code, since after PR #16494 there's no longer anything accessing either w or h in the code:

pdf.js/src/core/annotation.js

Lines 4100 to 4106 in 605d9f4

const [x1, y1, x2, y2] = rect;
let w = x2 - x1;
let h = y2 - y1;
if (rotation % 180 !== 0) {
[w, h] = [h, w];
}

On the question on why ESLint doesn't pick this up, I'm guessing that the answer is that it's a static code-analyzer which means that it cannot (generally) detect that the w and h assignments doesn't have side-effects (e.g. they could be getters).

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Projects
None yet
3 participants