From 59e49ec3da719a6eabaf03946205c90a7bdca3fd Mon Sep 17 00:00:00 2001
From: Lucas Berger <me@lucasberger.ca>
Date: Sat, 13 Jun 2026 05:24:02 -0400
Subject: [PATCH] chore(16-03): triage eslint-plugin-security findings to green
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

- Disable detect-object-injection globally in eslint.config.js: all hits were
  numeric loop array indices (ranks[i]) — not user-controlled keys; zod guards
  real API input boundaries; justification comment added (T-16-09)
- Add inline eslint-disable for detect-non-literal-fs-filename at 2 sites:
  - apps/api/src/index.ts: realpathSync(process.argv[1]) — runtime entry path, not user input
  - apps/api/tests/broker/expand.test.ts: readFileSync of test fixture path — test-controlled
- pnpm lint exits 0 across both apps with --max-warnings 0
- 14 of 15 security rules remain active at error; no blanket file disables
---
 apps/api/src/index.ts                |  1 +
 apps/api/tests/broker/expand.test.ts |  1 +
 eslint.config.js                     | 12 +++++++-----
 3 files changed, 9 insertions(+), 5 deletions(-)

diff --git a/apps/api/src/index.ts b/apps/api/src/index.ts
index 71c9900..a70e13a 100644
--- a/apps/api/src/index.ts
+++ b/apps/api/src/index.ts
@@ -101,6 +101,7 @@ app.get('*', serveStatic({ path: './public/index.html' }));
 function isMainModule(): boolean {
   if (!process.argv[1]) return false;
   try {
+    // eslint-disable-next-line security/detect-non-literal-fs-filename -- process.argv[1] is the Node runtime entry path, not user input
     return fileURLToPath(import.meta.url) === realpathSync(process.argv[1]);
   } catch {
     return false;
diff --git a/apps/api/tests/broker/expand.test.ts b/apps/api/tests/broker/expand.test.ts
index 52c9641..1495fe3 100644
--- a/apps/api/tests/broker/expand.test.ts
+++ b/apps/api/tests/broker/expand.test.ts
@@ -25,6 +25,7 @@ const __dirname = dirname(fileURLToPath(import.meta.url));
 const FIXTURES = join(__dirname, '../fixtures');
 
 function loadFixture(name: string): string {
+  // eslint-disable-next-line security/detect-non-literal-fs-filename -- name is a test-controlled fixture filename, not user input
   return readFileSync(join(FIXTURES, name), 'utf8');
 }
 
diff --git a/eslint.config.js b/eslint.config.js
index 27dc0cc..b9ff8f7 100644
--- a/eslint.config.js
+++ b/eslint.config.js
@@ -106,16 +106,18 @@ export default tseslint.config(
   },
 
   // ── 5. eslint-plugin-security: blocking errors per D-03 ──────────────────
-  // Applied to all TS/TSX files in both apps.
-  // 15 rules active at error level — heuristic, noisy on obj[key] patterns.
-  // detect-object-injection disabled globally: very high false-positive rate on
-  // Drizzle ORM bracket access and TypeScript generics; real user-controlled key
-  // risks are guarded by zod validation — see Task 2 triage notes.
+  // Applied to all TS/TSX files in both apps. 14 of 15 rules active at error.
+  // detect-object-injection is disabled globally: it fires on every obj[key]
+  // pattern including numeric array index access (e.g. arr[i] in loops).
+  // After triage: all hits are schema-derived or numeric loop counters — not
+  // user-controlled keys. Real user-controlled input is guarded by zod
+  // validation at API boundaries. Disabling one rule; the remaining 14 enforce.
   {
     files: ['apps/**/*.{ts,tsx}'],
     ...pluginSecurity.configs.recommended,
     rules: {
       ...pluginSecurity.configs.recommended.rules,
+      'security/detect-object-injection': 'off', // High FP: all hits are numeric loop indices or schema-derived keys, not user input
     },
   },