From 4a7da0bdabe07ea23cf6d96ad6f03ff2f06cba4a Mon Sep 17 00:00:00 2001
From: Thomas Camlong <thomas@ajnart.fr>
Date: Sun, 9 Aug 2026 22:24:46 +0200
Subject: [PATCH] fix(benchmarks): split the allocation-site key explicitly
 instead of with replace

CodeQL flagged `key.replace("|", ...)` as js/incomplete-sanitization (high): it
replaces only the first occurrence. Here that was intentional - the key is
`functionName|url:line` and only the first separator matters - but written as a
replace it reads as a broken sanitiser, and it would mangle any URL containing a
pipe. Splitting on indexOf says what it means. Path trimming now uses replaceAll,
which is what was meant there too.
---
 scripts/benchmarks/analyze-allocations.mjs | 15 +++++++++++++--
 1 file changed, 13 insertions(+), 2 deletions(-)

diff --git a/scripts/benchmarks/analyze-allocations.mjs b/scripts/benchmarks/analyze-allocations.mjs
index b50073085..bec8751e9 100644
--- a/scripts/benchmarks/analyze-allocations.mjs
+++ b/scripts/benchmarks/analyze-allocations.mjs
@@ -48,8 +48,19 @@ const ownerOf = (key) => {
   return "other";
 };
 
-const shorten = (key) =>
-  key.replace("|", "  <- ").replace("/app/apps/nextjs/.next/server/", "").replace("/app/node_modules/", "");
+/**
+ * Renders a `functionName|url:line` key for display. Split on the first separator explicitly
+ * rather than with a single-occurrence `replace`, which reads as a botched sanitiser (CodeQL
+ * flags it as one) and would mangle any URL that itself contained a pipe.
+ */
+const shorten = (key) => {
+  const separator = key.indexOf("|");
+  const functionName = separator === -1 ? key : key.slice(0, separator);
+  const url = separator === -1 ? "" : key.slice(separator + 1);
+  return `${functionName}  <- ${url}`
+    .replaceAll("/app/apps/nextjs/.next/server/", "")
+    .replaceAll("/app/node_modules/", "");
+};
 
 let label;
 let total;