diff --git a/src/security/temp-path-guard.test.ts b/src/security/temp-path-guard.test.ts index 034c8d14bbd..0aec1b67657 100644 --- a/src/security/temp-path-guard.test.ts +++ b/src/security/temp-path-guard.test.ts @@ -12,6 +12,8 @@ type QuoteScanState = { }; const WEAK_RANDOM_SAME_LINE_PATTERN = /(?:Date\.now[^\r\n]*Math\.random|Math\.random[^\r\n]*Date\.now)/u; +const PATH_JOIN_CALL_PATTERN = /path\s*\.\s*join\s*\(/u; +const OS_TMPDIR_CALL_PATTERN = /os\s*\.\s*tmpdir\s*\(/u; function shouldSkip(relativePath: string): boolean { return shouldSkipGuardrailRuntimeSource(relativePath); @@ -144,10 +146,12 @@ function isOsTmpdirExpression(argument: string): boolean { } function mightContainDynamicTmpdirJoin(source: string): boolean { + if (!source.includes("path") || !source.includes("join") || !source.includes("tmpdir")) { + return false; + } return ( - source.includes("path") && - source.includes("path.join") && - source.includes("os.tmpdir") && + (source.includes("path.join") || PATH_JOIN_CALL_PATTERN.test(source)) && + (source.includes("os.tmpdir") || OS_TMPDIR_CALL_PATTERN.test(source)) && source.includes("`") && source.includes("${") ); @@ -220,9 +224,6 @@ describe("temp path guard", () => { for (const file of files) { const relativePath = file.relativePath; - if (shouldSkip(relativePath)) { - continue; - } if (hasDynamicTmpdirJoin(file.source)) { offenders.push(relativePath); }