fix: codeql issue for insecure temporary file by qinzhouxu · Pull Request #16173 · OfficeDev/microsoft-365-agents-toolkit

qinzhouxu · 2026-06-17T08:23:52Z

https://dev.azure.com/msazure/Microsoft%20Teams%20Extensibility/_workitems/edit/38459560

github-actions · 2026-06-17T08:24:53Z

❌ VscUse Test Plan — Tests unknown

Why these tests: Changed files are in packages/fx-core (core utility/security fix, not vscode-extension or templates), which is an infrastructure/non-template change, so only 2 smoke plans are selected as a basic sanity check.

Branch diff: qinzhouxu/codeql → dev

Plans run:

Basic_Custom_Engine_Azure_OpenAI_ts_Copilot_Remote_Debug
General_Teams_Agent_OpenAI_py_Remote_Debug

Step	Status
1️⃣ Build VSIX (CD)	✅ Done
2️⃣ Build Docker image	✅ Done
3️⃣ Run UI tests	❌ Tests unknown

ℹ️ How were these tests selected?

GitHub Copilot (Claude Sonnet 4.6, high reasoning) analysed the PR title, description, and the diff between
qinzhouxu/codeql and dev
to pick the most relevant test plans from packages/tests/vscuse/Index.md.

      appYaml.add(projectIdField);
-      await fs.writeFile(projectYamlPath, appYaml.toString()); // only write yaml file once instead of write yaml file after every command
+      if (!this.isInTempDirectory(projectYamlPath)) {
+        await fs.writeFile(projectYamlPath, appYaml.toString());


    appYaml.set("projectId", settings.trackingId);
-    await fs.writeFile(projectYamlPath, appYaml.toString());
+    if (!this.isInTempDirectory(projectYamlPath)) {
+      await fs.writeFile(projectYamlPath, appYaml.toString());


github-actions · 2026-06-17T08:27:52Z

E2E Test Selection — AI Selected

Why these tests: Changes to fx-core ManifestUtils.ts (teamsApp manifest handling) and settingsUtil.ts (cross-cutting core utility) map to teamsApp/, teamsAgent/, declarativeAgent/, and feature/multienv per rule 1; ManifestUtils is specifically used in manifest validation across all app types including declarative agents.

Cases selected (21):

./teamsApp/basicBot.tests.ts
./teamsApp/basicMessageExtension.tests.ts
./teamsApp/basicTab.tests.ts
./teamsAgent/DebugCustomCopilotBasicBot.tests.ts
./teamsAgent/teamsCollaboratorAgent.tests.ts
./teamsAgent/DebugCustomCopilotRagAiSearchBot.tests.ts
./teamsAgent/DebugCustomCopilotRagBasicBot.tests.ts
./declarativeAgent/DeclarativeAgentBasic.tests.ts
./declarativeAgent/DeclarativeAgentWithApiKeyAuth.tests.ts
./declarativeAgent/DeclarativeAgentWithOAuth.tests.ts
./declarativeAgent/DeclarativeAgentInvalidManifestShape.tests.ts
./declarativeAgent/mcp/DeclarativeAgentMCPNoAuth.tests.ts
./declarativeAgent/mcp/DeclarativeAgentMCPAuthEdgeCases.tests.ts
./declarativeAgent/mcp/DeclarativeAgentMCPWithAuth.tests.ts
./declarativeAgent/DeclarativeAgentWithEntra.tests.ts
./declarativeAgent/typespec/typespec.withoutAction.tests.ts
./declarativeAgent/typespec/typespec.withAction.tests.ts
./declarativeAgent/DeclarativeAgentWithNoneAuth.tests.ts
./declarativeAgent/addKnowledge/AddWebSearchByAll.tests.ts
./declarativeAgent/addKnowledge/AddWebSearchByUrl.tests.ts
./feature/multienv.tests.ts

View pipeline run

Need to run more tests?

Comment on this PR:

/e2e-run ./path/to/test.tests.ts — add specific cases to AI selection
/e2e-run-all — run all e2e cases

Then re-run the workflow.

…ile' Co-authored-by: Copilot Autofix powered by AI <62310815+github-advanced-security[bot]@users.noreply.github.com>

github-actions · 2026-06-17T08:31:19Z

❌ VscUse Test Plan — Tests unknown

Why these tests: Changed files are in packages/fx-core (core utility/driver code, not templates or vscode-extension UI), which is a cross-cutting infrastructure fix; applying 2 smoke plans as a basic sanity check.

Branch diff: qinzhouxu/codeql → dev

Plans run:

Basic_Custom_Engine_Azure_OpenAI_ts_Copilot_Remote_Debug
General_Teams_Agent_OpenAI_py_Remote_Debug

Step	Status
1️⃣ Build VSIX (CD)	✅ Done
2️⃣ Build Docker image	✅ Done
3️⃣ Run UI tests	❌ Tests unknown

ℹ️ How were these tests selected?

GitHub Copilot (Claude Sonnet 4.6, high reasoning) analysed the PR title, description, and the diff between
qinzhouxu/codeql and dev
to pick the most relevant test plans from packages/tests/vscuse/Index.md.

…ile' Co-authored-by: Copilot Autofix powered by AI <62310815+github-advanced-security[bot]@users.noreply.github.com>

github-actions · 2026-06-17T08:32:40Z

❌ VscUse Test Plan — Tests failure

Why these tests: Changed files are in packages/fx-core (core utility/infra fixes for insecure temp file, not VS Code extension or templates), so only 2 smoke plans are selected as a basic sanity check.

Branch diff: qinzhouxu/codeql → dev

Plans run:

Basic_Custom_Engine_Azure_OpenAI_ts_Copilot_Remote_Debug
General_Teams_Agent_OpenAI_py_Remote_Debug

Step	Status
1️⃣ Build VSIX (CD)	✅ Done
2️⃣ Build Docker image	✅ Done
3️⃣ Run UI tests	❌ Tests failure

🔗 Full pipeline results

ℹ️ How were these tests selected?

GitHub Copilot (Claude Sonnet 4.6, high reasoning) analysed the PR title, description, and the diff between
qinzhouxu/codeql and dev
to pick the most relevant test plans from packages/tests/vscuse/Index.md.

github-actions · 2026-06-22T03:09:14Z

✅ VscUse Test Plan — All tests passed

Why these tests: Changes are in packages/fx-core (core infra, not vscode-extension or templates), fixing a CodeQL security issue in utility files — treated as trivial/infra changes warranting only 1-2 smoke plans.

Branch diff: qinzhouxu/codeql → dev

Plans run:

Basic_Custom_Engine_Azure_OpenAI_ts_Copilot_Remote_Debug
General_Teams_Agent_OpenAI_py_Remote_Debug

Step	Status
1️⃣ Build VSIX (CD)	✅ Done
2️⃣ Build Docker image	✅ Done
3️⃣ Run UI tests	✅ All tests passed

🎯 Actual UI test run
🔗 Full pipeline results
📊 Detailed test report

ℹ️ How were these tests selected?

GitHub Copilot (Claude Sonnet 4.6, high reasoning) analysed the PR title, description, and the diff between
qinzhouxu/codeql and dev
to pick the most relevant test plans from packages/tests/vscuse/Index.md.

fix: codeql issue for insecure temporary file

9b697f8

qinzhouxu requested review from HuihuiWu-Microsoft, qfai, tecton and wh-alice as code owners June 17, 2026 08:23

qinzhouxu temporarily deployed to engineering June 17, 2026 08:24 — with GitHub Actions Inactive

github-advanced-security AI found potential problems Jun 17, 2026

View reviewed changes

qinzhouxu temporarily deployed to engineering June 17, 2026 08:28 — with GitHub Actions Inactive

qinzhouxu had a problem deploying to engineering June 17, 2026 08:28 — with GitHub Actions Failure

qinzhouxu temporarily deployed to engineering June 17, 2026 08:28 — with GitHub Actions Inactive

qinzhouxu requested a review from Copilot June 17, 2026 08:29

Copilot started reviewing on behalf of qinzhouxu June 17, 2026 08:29 View session

Potential fix for pull request finding 'CodeQL / Insecure temporary f…

ee4afac

…ile' Co-authored-by: Copilot Autofix powered by AI <62310815+github-advanced-security[bot]@users.noreply.github.com>

qinzhouxu temporarily deployed to engineering June 17, 2026 08:30 — with GitHub Actions Inactive

Potential fix for pull request finding 'CodeQL / Insecure temporary f…

46fd5a1

…ile' Co-authored-by: Copilot Autofix powered by AI <62310815+github-advanced-security[bot]@users.noreply.github.com>

qinzhouxu had a problem deploying to engineering June 17, 2026 08:31 — with GitHub Actions Failure

qinzhouxu temporarily deployed to engineering June 17, 2026 08:59 — with GitHub Actions Inactive

qinzhouxu had a problem deploying to engineering June 17, 2026 08:59 — with GitHub Actions Failure

qinzhouxu temporarily deployed to engineering June 17, 2026 08:59 — with GitHub Actions Inactive

fix: codeql issue for insecure temporary file

6952acd

qinzhouxu temporarily deployed to engineering June 22, 2026 03:08 — with GitHub Actions Inactive

qinzhouxu had a problem deploying to engineering June 22, 2026 03:12 — with GitHub Actions Failure

qinzhouxu temporarily deployed to engineering June 22, 2026 03:12 — with GitHub Actions Inactive

qinzhouxu had a problem deploying to engineering June 22, 2026 03:12 — with GitHub Actions Failure

qinzhouxu temporarily deployed to engineering June 22, 2026 03:12 — with GitHub Actions Inactive

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

fix: codeql issue for insecure temporary file#16173

fix: codeql issue for insecure temporary file#16173
qinzhouxu wants to merge 6 commits into
devfrom
qinzhouxu/codeql

qinzhouxu commented Jun 17, 2026

Uh oh!

github-actions Bot commented Jun 17, 2026 •

edited

Loading

Uh oh!

github-actions Bot commented Jun 17, 2026 •

edited

Loading

Uh oh!

github-actions Bot commented Jun 17, 2026 •

edited

Loading

Uh oh!

github-actions Bot commented Jun 17, 2026 •

edited

Loading

Uh oh!

github-actions Bot commented Jun 22, 2026 •

edited

Loading

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

Uh oh!

Conversation

qinzhouxu commented Jun 17, 2026

Uh oh!

github-actions Bot commented Jun 17, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

❌ VscUse Test Plan — Tests unknown

Uh oh!

github-actions Bot commented Jun 17, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

E2E Test Selection — AI Selected

Uh oh!

github-actions Bot commented Jun 17, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

❌ VscUse Test Plan — Tests unknown

Uh oh!

github-actions Bot commented Jun 17, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

❌ VscUse Test Plan — Tests failure

Uh oh!

github-actions Bot commented Jun 22, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

✅ VscUse Test Plan — All tests passed

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

github-actions Bot commented Jun 17, 2026 •

edited

Loading

github-actions Bot commented Jun 17, 2026 •

edited

Loading

github-actions Bot commented Jun 17, 2026 •

edited

Loading

github-actions Bot commented Jun 17, 2026 •

edited

Loading

github-actions Bot commented Jun 22, 2026 •

edited

Loading