Security: Identity (no-op) string replacement in errorInspector helpers (CodeQL alert #23)
Author: nthmost-orkesCreated Sep 17, 2026Updated Sep 17, 2026
Labelsbugsecurity
CodeQL alert #23 · rule js/identity-replacement · severity medium
File: `ui-next/src/pages/definition/errorInspector/state/helpers.ts:194`
Sub-issue of #1010.
Problem
A `String.replace` at line 194 replaces a substring with itself (identity replacement), so the call is a no-op. Usually indicates the intended sanitization/escaping/transformation isn't actually happening.
Fix direction
Open the source, determine the intended transformation, and fix the replacement (correct replacement value, or a global/regex form if all occurrences were meant to be handled). Add a test that asserts the transformed output.
Source: conductor-oss/conductor