Merge pull request #14 from decksoftware/fix/clear-semgrep-warnings

fix(security): clear 2 Semgrep code-scanning warnings on csreview's own source

Author: decksoftware

csreview/src/dumpGuide.js

@@ -5,6 +5,7 @@
 // detects which backends a project uses and renders an instructional HTML report.
 import fs from 'fs';
 import path from 'path';
+import { safeResolveInside } from './pathSafety.js';
 
 function escapeHtml(value) {
   return String(value ?? '')
@@ -292,8 +293,11 @@ ${cards}
 
 function readPackageDeps(rootDir) {
   try {
-    const pkgPath = path.join(rootDir, 'package.json');
-    if (!fs.existsSync(pkgPath)) return [];
+    // Contained resolution (rejects traversal / absolute escapes) instead of a
+    // raw path.join — the joined component is a constant, but this keeps the
+    // codebase's read-only safe-path invariant and clears the scanner warning.
+    const pkgPath = safeResolveInside(rootDir, 'package.json');
+    if (!pkgPath || !fs.existsSync(pkgPath)) return [];
     const pkg = JSON.parse(fs.readFileSync(pkgPath, 'utf8'));
     return Object.keys({
       ...(pkg.dependencies || {}),

csreview/src/ignore.js

@@ -98,7 +98,12 @@ export function patternToMatcher(rawPattern) {
   const body = translateGlob(pattern);
   const prefix = anchored || hasSlash ? '^' : '(?:^|.*/)';
   const suffix = dirOnly ? '(?:/.*)?$' : '$';
-  return { negate, re: new RegExp(prefix + body + suffix) };
+  // ReDoS-hardened dynamic RegExp: globstar runs are collapsed and patterns with
+  // >100 wildcards are refused above; the input is a sanitized glob from the
+  // user's own .csreview-ignore or built-in defaults (a local dev tool), and the
+  // behaviour is unit-tested (ignore.test.js "ReDoS H1"). The dynamic RegExp is
+  // intrinsic to a glob matcher, so this audit finding is suppressed inline.
+  return { negate, re: new RegExp(prefix + body + suffix) }; // nosemgrep: javascript.lang.security.audit.detect-non-literal-regexp.detect-non-literal-regexp
 }
 
 /**