Skip to content

Conversation

@VaradaNambiar
Copy link
Collaborator

Potential fix for https://github.com/arup-group/github-action-benchmark/security/code-scanning/2

To fix the overly permissive regular expression range, we need to ensure that the dash (-) character in the character class is treated as a literal - rather than the beginning of or part of a range. The standard ways to do this are:

  1. Escape the dash with a backslash (\-).
  2. Move the dash to the beginning or end of the character class.

In this case, inside the regex /^(?<name>Benchmark\w+[\w()$%^&*-=|,[\]{}"#]*?)(?<procs>-\d+)?\s+(?<times>\d+)\s+(?<remainder>.+)$/;, we should escape the dash:
Change [\w()$%^&*-=|,[\]{}"#]*? to [\w()$%^&*\-=|,[\]{}"#]*?.

Update the regular expression on line 360 of src/extract.ts with the escaped dash. No new imports or additional code changes are needed.


Suggested fixes powered by Copilot Autofix. Review carefully before merging.

…r expression range

Co-authored-by: Copilot Autofix powered by AI <62310815+github-advanced-security[bot]@users.noreply.github.com>
@VaradaNambiar VaradaNambiar marked this pull request as ready for review December 10, 2025 11:22
@VaradaNambiar
Copy link
Collaborator Author

This change failed a lot of the pipeline checks. I gather from this that the original code is right and permissive rather than over permissive.

Closing this PR and dismissing the alert.

@VaradaNambiar VaradaNambiar deleted the alert-autofix-2 branch December 10, 2025 11:34
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants