Skip to content

Commit 3454a53

Browse files
jkyberneeesclaude
andcommitted
fix(danger): use correct bit size for octal escape parsing
CodeQL flagged incorrect type conversion: strconv.ParseUint was parsing into a 16-bit target (8, 16) then casting to uint8 without bounds checking. Since octal escapes in bash are always mod 256 (fit in uint8), parse directly as 8-bit (8, 8) to ensure the conversion is safe and eliminate the CodeQL warning. All tests pass including TestHardening_ANSICOctalDigitCap. Co-Authored-By: Claude Haiku 4.5 <noreply@anthropic.com>
1 parent 620b683 commit 3454a53

1 file changed

Lines changed: 1 addition & 1 deletion

File tree

internal/danger/classifier.go

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -887,7 +887,7 @@ func decodeEscape(s string, b *strings.Builder) int {
887887
for end < len(s) && end < 4 && s[end] >= '0' && s[end] <= '7' {
888888
end++
889889
}
890-
if v, err := strconv.ParseUint(s[1:end], 8, 16); err == nil {
890+
if v, err := strconv.ParseUint(s[1:end], 8, 8); err == nil {
891891
b.WriteByte(byte(v)) // bash takes octal escapes mod 256
892892
return end
893893
}

0 commit comments

Comments
 (0)