Repository navigation
mpv host 8: one exit (fixes code scanning #183) - #437
Merged
Merged
Conversation
Each branch of main() ended with its own process.exit(0) behind a check of the message, and CodeQL counts process.exit as a sensitive action: the check before it - whether an mpv exists for the options page's path - read as user input deciding it (js/user-controlled-bypass; #111 the same at the http(s) check). handleMessage() now only returns, and main() exits once after it. Same behaviour: every branch sends its answer first, then the host ends. HostVersion and RequiredHostVersion 8, hashes recorded. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Owner
Author
|
Full-scan proof (run 38154906661, throwaway branch
The other hits of this rule are the same on both, in tools/ and tests/e2e/, and were dismissed before (#112–#120). One result fewer, and none new: once this is merged, main's next scan closes #183. |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Code scanning #183 (js/user-controlled-bypass, high)
process.exitis a "sensitive action" to it (NodeJSLib.qll,ProcessTermination).main()ended with its ownprocess.exit(0). The check in front of it, whether an mpv exists for the options page's path, therefore looked like "user input decides a sensitive action". Alert test: property tests for the parsers a page feeds (T8) #111 was the same thing at the http(s) check; it was dismissed as a false positive and came back as Volume bar, audio knobs, subtitle position and the audio-menu drag start on any mouse button and never end when released outside the player #183 when mpv host 6: FASTSTREAM_MPV_DEBUG=0 means off; installer saves the full mpv path #424 moved the code.handleMessage()now only returns, andmain()exits once, unconditionally, after it. No check stands in front of an exit any more.Version
HostVersionandRequiredHostVersion8, hashes recorded (the repo rule for every helper change). After the merge: run mpv'supdater.batonce more (it installs helper 8; 7 → 8 changes nothing you'd notice).Proof
A PR scan only looks at changed lines, so its "no new alerts" proves nothing (#168, 2026-10-06). A full CodeQL scan runs on a throwaway branch (
scan/host-exit-proof) with the repo's own settings (security-extended, local sources). main is the control and must reproduce the alert; the fix must not. The result goes here as a comment; the branch is deleted afterwards.Locally: vitest 2260, lint, typecheck.
🤖 Generated with Claude Code