The GitHub Actions job "CI" on grails-core.git/perf/request-path-8.0.x has succeeded. Run started by GitHub user codeconsole (triggered by codeconsole).
Head commit for run: 39e09dab2edb9389c7faba4832e4abff391f74e5 / Scott Murphy Heiberg <[email protected]> refactor: resolve a mapping token through doCall rather than a call override CodeQL raised eleven java/xss alerts on this branch. Every sink is in grails-encoder, a module the branch does not touch, and every recorded flow runs through one edge: RuntimeConstraintEvaluator.call(Object...) is a Java override of Closure.call, so the analysis admits it as a callee of unrelated Closure.call sites - GSP tag closures at GroovyPage:514, marshaller closures at ClosureObjectMarshaller:56 - and carries request parameters from here into the encoders. That dispatch cannot happen. Instances exist only in RegexUrlMapping's controller, action, namespace, view and redirect fields, and the code holding those fields resolves the token by name instead of calling it: AbstractUrlMappingInfo.evaluateNameForValue tests for the type ahead of its Closure branch, and DefaultUrlMappingInfo excludes it from isNameResolutionRequestDependent. The alerts are new because this branch promoted an anonymous closure in RegexUrlMapping to a named class with the same body; the analysis ignores the anonymous one at those call sites and admits the named one. doCall is the name Closure.call already resolves through the metaclass, so the fallback behaves as before while the override leaves the Closure type surface. Running the CI toolchain over the branch reports eleven alerts for the override and none for this shape, with the tolerant parameter read unchanged either way. The evaluator had no test of its own. The spec covers both halves of the class javadoc: a name captured from the URI is resolved from the match rather than from whatever request is bound, and calling the evaluator directly reads the request that is bound at that moment. Renaming doCall fails the second half and leaves the first passing, which is the split the class documents. Report URL: https://github.com/apache/grails-core/actions/runs/33357786193 With regards, GitHub Actions via GitBox
