fix: 修复CodeQL检测到的代码问题
This commit is contained in:
@@ -36,24 +36,32 @@ function updateModuleSizes() {
|
|||||||
}
|
}
|
||||||
|
|
||||||
try {
|
try {
|
||||||
// Read module.json first
|
// Get actual file size first (independent of module.json)
|
||||||
const content = fs.readFileSync(moduleJsonPath, 'utf-8');
|
|
||||||
const moduleJson = JSON.parse(content);
|
|
||||||
const oldSize = moduleJson.estimatedSize;
|
|
||||||
|
|
||||||
// Get actual file size
|
|
||||||
const stat = fs.statSync(distIndexPath);
|
const stat = fs.statSync(distIndexPath);
|
||||||
const actualSize = stat.size;
|
const actualSize = stat.size;
|
||||||
|
|
||||||
// Update if different
|
// Use file descriptor to atomically read and write module.json
|
||||||
if (oldSize !== actualSize) {
|
// This prevents TOCTOU race condition
|
||||||
moduleJson.estimatedSize = actualSize;
|
const fd = fs.openSync(moduleJsonPath, 'r+');
|
||||||
const newContent = JSON.stringify(moduleJson, null, 2) + '\n';
|
try {
|
||||||
fs.writeFileSync(moduleJsonPath, newContent, 'utf-8');
|
const content = fs.readFileSync(fd, 'utf-8');
|
||||||
const oldKB = oldSize ? (oldSize / 1024).toFixed(1) : 'N/A';
|
const moduleJson = JSON.parse(content);
|
||||||
const newKB = (actualSize / 1024).toFixed(1);
|
const oldSize = moduleJson.estimatedSize;
|
||||||
console.log(` ${pkg}: ${oldKB} KB -> ${newKB} KB`);
|
|
||||||
updated++;
|
// Update if different
|
||||||
|
if (oldSize !== actualSize) {
|
||||||
|
moduleJson.estimatedSize = actualSize;
|
||||||
|
const newContent = JSON.stringify(moduleJson, null, 2) + '\n';
|
||||||
|
// Truncate and write using the same file descriptor
|
||||||
|
fs.ftruncateSync(fd, 0);
|
||||||
|
fs.writeSync(fd, newContent, 0, 'utf-8');
|
||||||
|
const oldKB = oldSize ? (oldSize / 1024).toFixed(1) : 'N/A';
|
||||||
|
const newKB = (actualSize / 1024).toFixed(1);
|
||||||
|
console.log(` ${pkg}: ${oldKB} KB -> ${newKB} KB`);
|
||||||
|
updated++;
|
||||||
|
}
|
||||||
|
} finally {
|
||||||
|
fs.closeSync(fd);
|
||||||
}
|
}
|
||||||
} catch (err) {
|
} catch (err) {
|
||||||
console.error(` Error processing ${pkg}:`, err.message);
|
console.error(` Error processing ${pkg}:`, err.message);
|
||||||
|
|||||||
Reference in New Issue
Block a user