FP: SKY-D212 on RegExp.exec() — receiver check is a variable-name allowlist

[idkned]

What was flagged?

• File: app.ts
• Name: codeBlockRegex.exec(rawContent)
• Category: security

app.ts:6  SKY-D212  child_process.exec() can lead to command injection. Use execFile() instead.

Why is it a false positive?

codeBlockRegex is a regex literal. .exec() is RegExp.prototype.exec. There is no child_process import in the file.

The guard is a name allowlist, _SAFE_EXEC_OBJECTS at skylos/visitors/languages/typescript/danger.py:34: regex, re, regexp, pattern, reg, db, stmt, query, statement, cursor, conn, connection. Anything outside those twelve names gets flagged. The rule never looks at what the variable holds.

Skylos version

4.35.0

Minimal reproduction

app.ts:

const codeBlockRegex = /x(y)?z/gi;

export function findBlocks(rawContent: string): string[] {
    const blocks: string[] = [];
    let match: RegExpExecArray | null;
    while ((match = codeBlockRegex.exec(rawContent)) !== null) {
        blocks.push(match[1]);
    }
    return blocks;
}

skylos . --danger --format concise --no-provenance --no-upload

app.ts:6  SKY-D212  child_process.exec() can lead to command injection. Use execFile() instead.

Rename it regex and the finding disappears. Rename it matcher and it stays.
Checked via scan_danger on 4.35.0:

receiver	result
regex	clean
pattern	clean
codeBlockRegex	SKY-D212
matcher	SKY-D212

Fixing it properly means checking the binding's initializer (regex literal or new RegExp(...)), not the name. _child_process_aliases in the same file already works that way — off actual require("child_process") evidence.