#1642·conductor

Security: Identity (no-op) string replacement in errorInspector helpers (CodeQL alert #23)

Author: nthmost-orkesCreated Sep 17, 2026Updated Sep 17, 2026
Labelsbugsecurity

CodeQL alert #23 · rule js/identity-replacement · severity medium File: `ui-next/src/pages/definition/errorInspector/state/helpers.ts:194`

Sub-issue of #1010.

Problem

A `String.replace` at line 194 replaces a substring with itself (identity replacement), so the call is a no-op. Usually indicates the intended sanitization/escaping/transformation isn't actually happening.

Fix direction

Open the source, determine the intended transformation, and fix the replacement (correct replacement value, or a global/regex form if all occurrences were meant to be handled). Add a test that asserts the transformed output.