Skip to content

Remove stale LGTM suppression pragma#40

Merged
mcgroarty merged 1 commit into
mainfrom
harden/remove-stale-lgtm-pragma
Jun 4, 2026
Merged

Remove stale LGTM suppression pragma#40
mcgroarty merged 1 commit into
mainfrom
harden/remove-stale-lgtm-pragma

Conversation

@mcgroarty
Copy link
Copy Markdown
Contributor

Removes a // lgtm[js/http-to-file-access] comment in scripts/fetch-definitions.js that has been a no-op since LGTM.com was retired in 2022. Modern CodeQL does not honor inline LGTM pragmas, so it was creating a false sense of suppression.

The explanatory comment above it is preserved.

The associated CodeQL alert will be dismissed as a false positive separately: OUTPUT_PATH is derived from import.meta.url at module load and cannot be influenced by the HTTP response, so there is no path-traversal/arbitrary-write risk.

The // lgtm[js/http-to-file-access] pragma was a no-op: LGTM.com was
retired in 2022 and modern CodeQL does not read those comments. The
explanatory comment above it documents the same reasoning, so the
pragma is removed without behavior change.

The CodeQL alert itself will be dismissed as a false positive
(OUTPUT_PATH is derived from import.meta.url and cannot be influenced
by the network response).
Copy link
Copy Markdown

Copilot AI left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Pull request overview

This PR removes a stale LGTM inline suppression pragma from scripts/fetch-definitions.js. Since LGTM.com was retired and modern CodeQL does not honor LGTM pragmas, keeping the comment could mislead maintainers into thinking the issue is suppressed when it isn’t.

Changes:

  • Removed the // lgtm[js/http-to-file-access] pragma comment.
  • Kept the surrounding explanatory comment clarifying why OUTPUT_PATH is not influenced by the HTTP response.

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

@mcgroarty mcgroarty merged commit bbc6485 into main Jun 4, 2026
6 checks passed
@mcgroarty mcgroarty deleted the harden/remove-stale-lgtm-pragma branch June 4, 2026 01:53
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants