Fix code scanning alert 3 false positive (#5154)

Author: Widthdom

src/CodeIndex/Cli/GitHelper.cs

@@ -94,15 +94,17 @@ internal static TimeSpan GitCommandTimeout
         set => GitCommandTimeoutOverride.Value = value;
     }
 
-    private static readonly Lazy<GitExecutableResolution> TrustedGitExecutable = new(ResolveTrustedGitExecutableFromKnownLocations);
+    // CodeQL treats identifiers containing "trusted" as secret-bearing. These values are
+    // validated executable paths, not secrets, so keep the internal data-flow names explicit.
+    private static readonly Lazy<GitExecutableResolution> ValidatedGitExecutable = new(ResolveValidatedGitExecutableFromKnownLocations);
     private static readonly AsyncLocal<string?> GitExecutablePathOverrideValue = new();
     internal static string? GitExecutablePathOverride
     {
         get => GitExecutablePathOverrideValue.Value;
         set => GitExecutablePathOverrideValue.Value = value;
     }
 
-    private const string TrustedGitUnavailableMessage =
+    private const string ValidatedGitUnavailableMessage =
         "Could not resolve a trusted git executable path. Install git in a standard system location or set CDIDX_GIT_EXECUTABLE to a trusted absolute path. / 信頼済みの git 実行ファイルパスを解決できませんでした。標準のシステム場所に git をインストールするか、CDIDX_GIT_EXECUTABLE に信頼できる絶対パスを設定してください。";
 
     private sealed record GitExecutableResolution(string? Path, GitExecutableStatus Status);
@@ -126,19 +128,19 @@ private sealed record GitExecutableResolution(string? Path, GitExecutableStatus
     }
 
     private static ProcessStartInfo CreateGitStartInfoOrThrow(string projectRoot)
-        => TryCreateGitStartInfo(projectRoot) ?? throw new InvalidOperationException(TrustedGitUnavailableMessage);
+        => TryCreateGitStartInfo(projectRoot) ?? throw new InvalidOperationException(ValidatedGitUnavailableMessage);
 
     private static string? TryResolveGitExecutablePath()
     {
-        var overridePath = NormalizeTrustedGitExecutablePath(GitExecutablePathOverrideValue.Value);
+        var overridePath = NormalizeValidatedGitExecutablePath(GitExecutablePathOverrideValue.Value);
         if (overridePath != null)
             return overridePath;
 
         var environmentValue = global::CodeIndex.EnvironmentAccess.GetProcessEnvironmentVariable(GitExecutableEnvironmentVariable);
         if (environmentValue != null)
             return EvaluateGitExecutableCandidate(environmentValue, "environment_override").Path;
 
-        return TrustedGitExecutable.Value.Path;
+        return ValidatedGitExecutable.Value.Path;
     }
 
     internal static string? TryResolveGitExecutablePathForHook()
@@ -158,7 +160,7 @@ internal static bool TryValidatePinnedGitExecutablePathForHook(
 
     public static GitExecutableStatus GetGitExecutableStatus()
     {
-        var overridePath = NormalizeTrustedGitExecutablePath(GitExecutablePathOverrideValue.Value);
+        var overridePath = NormalizeValidatedGitExecutablePath(GitExecutablePathOverrideValue.Value);
         if (overridePath != null)
         {
             return new GitExecutableStatus(
@@ -177,7 +179,7 @@ public static GitExecutableStatus GetGitExecutableStatus()
         var environmentValue = global::CodeIndex.EnvironmentAccess.GetProcessEnvironmentVariable(GitExecutableEnvironmentVariable);
         return environmentValue != null
             ? EvaluateGitExecutableCandidate(environmentValue, "environment_override").Status
-            : TrustedGitExecutable.Value.Status;
+            : ValidatedGitExecutable.Value.Status;
     }
 
     internal static IReadOnlyList<ExtensionTrustOverride> GetAcceptedTrustOverrides(GitExecutableStatus status)
@@ -199,9 +201,9 @@ internal static IReadOnlyList<ExtensionTrustOverride> GetAcceptedTrustOverrides(
         ];
     }
 
-    private static GitExecutableResolution ResolveTrustedGitExecutableFromKnownLocations()
+    private static GitExecutableResolution ResolveValidatedGitExecutableFromKnownLocations()
     {
-        foreach (var candidate in EnumerateTrustedGitExecutableCandidates())
+        foreach (var candidate in EnumerateValidatedGitExecutableCandidates())
         {
             var resolution = EvaluateGitExecutableCandidate(candidate, "known_location");
             if (resolution.Path != null)
@@ -220,7 +222,7 @@ private static GitExecutableResolution ResolveTrustedGitExecutableFromKnownLocat
             ancestorDirectoriesTrusted: null);
     }
 
-    private static IEnumerable<string> EnumerateTrustedGitExecutableCandidates()
+    private static IEnumerable<string> EnumerateValidatedGitExecutableCandidates()
     {
         if (OperatingSystem.IsWindows())
         {
@@ -255,10 +257,10 @@ private static IEnumerable<string> EnumerateTrustedGitExecutableCandidates()
         yield return "/bin/git";
     }
 
-    internal static IReadOnlyList<string> TrustedGitExecutableCandidatePathsForTests()
-        => EnumerateTrustedGitExecutableCandidates().ToList();
+    internal static IReadOnlyList<string> ValidatedGitExecutableCandidatePathsForTests()
+        => EnumerateValidatedGitExecutableCandidates().ToList();
 
-    private static string? NormalizeTrustedGitExecutablePath(string? path)
+    private static string? NormalizeValidatedGitExecutablePath(string? path)
     {
         if (string.IsNullOrWhiteSpace(path))
             return null;
@@ -803,7 +805,7 @@ private static void ValidateSingleCommitRef(
         CancellationToken cancellationToken = default)
     {
         if (TryResolveGitExecutablePath() == null)
-            throw new InvalidOperationException(TrustedGitUnavailableMessage);
+            throw new InvalidOperationException(ValidatedGitUnavailableMessage);
 
         // Reject range/pathspec syntax before invoking git so --commits remains a list
         // of single commit-ish values, not revision-set expressions.
@@ -1441,7 +1443,7 @@ private static GitCommandResult RunGitCapturingResult(
             var psi = TryCreateGitStartInfo(projectRoot);
             if (psi == null)
             {
-                var diagnostic = FormatGitDiagnostic(TrustedGitUnavailableMessage);
+                var diagnostic = FormatGitDiagnostic(ValidatedGitUnavailableMessage);
                 return new GitCommandResult(
                     null,
                     null,

src/CodeIndex/Cli/HookCommandRunner.cs

@@ -1862,10 +1862,10 @@ private static bool TryAnalyzeRuntimeWorktreeInvocation(
 
         var pinnedGitAvailable = GitHelper.TryValidatePinnedGitExecutablePathForHook(
             installedGitExecutablePath,
-            out var trustedGitExecutablePath);
+            out var validatedGitExecutablePath);
         if (!TryBuildHookScript(
                 installedChainedHookPath,
-                pinnedGitAvailable ? trustedGitExecutablePath : installedGitExecutablePath,
+                pinnedGitAvailable ? validatedGitExecutablePath : installedGitExecutablePath,
                 selection,
                 out var expectedText)
             || !TryExtractManagedBlock(expectedText, out var expectedBlock)

tests/CodeIndex.Tests/GitHelperTests.cs

@@ -596,29 +596,29 @@ public async Task GetChangedFilesFromCommit_DrainsLargeStderrWithoutDeadlock()
     }
 
     [ExternalProcessFact]
-    public void GetChangedFilesFromCommit_UsesTrustedGitExecutableInsteadOfPath_Issue3433()
+    public void GetChangedFilesFromCommit_UsesValidatedGitExecutableInsteadOfPath_Issue3433()
     {
         if (OperatingSystem.IsWindows())
             return;
 
-        var repoDir = Path.Combine(_tempDir, "repo-trusted-git");
+        var repoDir = Path.Combine(_tempDir, "repo-validated-git");
         Directory.CreateDirectory(repoDir);
-        var trustedGitDir = Path.Combine(_tempDir, "trusted-git");
+        var validatedGitDir = Path.Combine(_tempDir, "validated-git");
         var pathGitDir = Path.Combine(_tempDir, "path-git");
-        Directory.CreateDirectory(trustedGitDir);
+        Directory.CreateDirectory(validatedGitDir);
         Directory.CreateDirectory(pathGitDir);
-        WriteFakeGitThatReturnsChangedFile(trustedGitDir, "trusted.txt");
+        WriteFakeGitThatReturnsChangedFile(validatedGitDir, "validated.txt");
         WriteFakeGitThatReturnsChangedFile(pathGitDir, "path.txt");
 
         var oldPath = Environment.GetEnvironmentVariable("PATH");
         var oldGitExecutablePath = GitHelper.GitExecutablePathOverride;
         Environment.SetEnvironmentVariable("PATH", pathGitDir + Path.PathSeparator + oldPath);
-        GitHelper.GitExecutablePathOverride = Path.Combine(trustedGitDir, "git");
+        GitHelper.GitExecutablePathOverride = Path.Combine(validatedGitDir, "git");
         try
         {
             var changedFiles = GitHelper.GetChangedFilesFromCommit(repoDir, "0123456789abcdef");
 
-            Assert.Equal(["trusted.txt"], changedFiles);
+            Assert.Equal(["validated.txt"], changedFiles);
         }
         finally
         {
@@ -1070,12 +1070,12 @@ public void RunGitCapturingResult_CancelDuringOutputCapture_ThrowsOperationCance
     }
 
     [Fact]
-    public void TrustedGitExecutableCandidates_OnMacOS_ExcludeDeveloperToolsShim_Issue3433()
+    public void ValidatedGitExecutableCandidates_OnMacOS_ExcludeDeveloperToolsShim_Issue3433()
     {
         if (!OperatingSystem.IsMacOS())
             return;
 
-        var candidates = GitHelper.TrustedGitExecutableCandidatePathsForTests();
+        var candidates = GitHelper.ValidatedGitExecutableCandidatePathsForTests();
 
         Assert.DoesNotContain("/usr/bin/git", candidates);
         Assert.Contains("/Library/Developer/CommandLineTools/usr/bin/git", candidates);
@@ -1260,13 +1260,13 @@ public void GitExecutableEnvironmentOverride_WindowsRequiresTrustedAclBeforeProb
         if (!OperatingSystem.IsWindows())
             return;
 
-        var trustedGit = Assert.Single(
-            GitHelper.TrustedGitExecutableCandidatePathsForTests()
+        var validatedGit = Assert.Single(
+            GitHelper.ValidatedGitExecutableCandidatePathsForTests()
                 .Where(File.Exists)
                 .Take(1));
         var portableGitDir = TestProjectHelper.CreateTrustedWindowsGitDirectory("cdidx_windows_portable_git");
         var portableGitPath = Path.Combine(portableGitDir, "git.exe");
-        File.Copy(trustedGit, portableGitPath);
+        File.Copy(validatedGit, portableGitPath);
 
         using var env = EnvironmentVariableScope.Capture(GitHelper.GitExecutableEnvironmentVariable);
         var oldGitExecutablePath = GitHelper.GitExecutablePathOverride;