judges secure-coding.instructions.md

Secure Coding — Preventing CodeQL / Code Scanning Findings

Follow these rules when writing or modifying TypeScript code in this repository. They address the categories of findings that GitHub Code Scanning (CodeQL) flags.

---

1. Regex Safety (js/polynomial-redos)

Avoid regular expressions that can exhibit catastrophic backtracking.

• Never use nested quantifiers like (.+)*, (a+)+, (\s*)*, or (\S.*)$ with greedy/backtracking groups.
• Prefer string methods (indexOf, startsWith, endsWith, split, substring) over regex when the pattern is a fixed string or simple delimiter.
• When regex is necessary, use possessive-style character classes: [^ \t\n]* instead of .*, and [^\n]* instead of .+.
• \s in quantified positions is dangerous because it overlaps with [ \t] — prefer explicit [ \t] when you only need horizontal whitespace.
• If a pattern is anchored with $ and can only match once, do not use the /g flag.
• For parsing structured comment directives (e.g., // judges-ignore RULE-ID), use indexOf + substring instead of a single complex regex.

Bad:

const pattern = /(?:\/\/|#|\/\*)\s*judges-ignore\s+(.+)$/gi;

Good:

const idx = line.indexOf("judges-ignore");
if (idx >= 0) {
  const before = line.substring(0, idx).trimEnd();
  if (before.endsWith("//") || before.endsWith("#") || before.endsWith("/*")) {
    const rest = line.substring(idx + "judges-ignore".length).trimStart();
    // ... parse rest with string methods ...
  }
}

---

2. No Sensitive Data in Logs (js/clear-text-logging)

Never log values sourced from process.env — CodeQL treats all environment variables as sensitive.

• Use os.userInfo().username instead of process.env.USER or process.env.USERNAME when you need the current user's name.
• If you must read an env var, assign it to a local variable and do not pass that variable to console.log, console.error, or any logging function.

Bad:

const user = process.env.USER || "unknown";
console.log(`Action performed by ${user}`);