fix: 修复CodeQL检测到的代码问题

This commit is contained in:
yhh
2025-12-03 21:31:18 +08:00
parent 0a3f2a3e21
commit 94e0979941

View File

@@ -36,24 +36,32 @@ function updateModuleSizes() {
} }
try { try {
// Read module.json first // Get actual file size first (independent of module.json)
const content = fs.readFileSync(moduleJsonPath, 'utf-8');
const moduleJson = JSON.parse(content);
const oldSize = moduleJson.estimatedSize;
// Get actual file size
const stat = fs.statSync(distIndexPath); const stat = fs.statSync(distIndexPath);
const actualSize = stat.size; const actualSize = stat.size;
// Update if different // Use file descriptor to atomically read and write module.json
if (oldSize !== actualSize) { // This prevents TOCTOU race condition
moduleJson.estimatedSize = actualSize; const fd = fs.openSync(moduleJsonPath, 'r+');
const newContent = JSON.stringify(moduleJson, null, 2) + '\n'; try {
fs.writeFileSync(moduleJsonPath, newContent, 'utf-8'); const content = fs.readFileSync(fd, 'utf-8');
const oldKB = oldSize ? (oldSize / 1024).toFixed(1) : 'N/A'; const moduleJson = JSON.parse(content);
const newKB = (actualSize / 1024).toFixed(1); const oldSize = moduleJson.estimatedSize;
console.log(` ${pkg}: ${oldKB} KB -> ${newKB} KB`);
updated++; // Update if different
if (oldSize !== actualSize) {
moduleJson.estimatedSize = actualSize;
const newContent = JSON.stringify(moduleJson, null, 2) + '\n';
// Truncate and write using the same file descriptor
fs.ftruncateSync(fd, 0);
fs.writeSync(fd, newContent, 0, 'utf-8');
const oldKB = oldSize ? (oldSize / 1024).toFixed(1) : 'N/A';
const newKB = (actualSize / 1024).toFixed(1);
console.log(` ${pkg}: ${oldKB} KB -> ${newKB} KB`);
updated++;
}
} finally {
fs.closeSync(fd);
} }
} catch (err) { } catch (err) {
console.error(` Error processing ${pkg}:`, err.message); console.error(` Error processing ${pkg}:`, err.message);