CodeQL: exclude libtest demos and src/proxy from scanning

libtest/ holds demo callback samples that aren't part of libhttrack, and
src/proxy/ is ProxyTrack, a separate legacy binary with no auth surface whose
recv/cache-parse code trips the taint queries by design. Together they account
for ~26 alerts that are false-positive or by-design. Exclude both so the
dashboard tracks the engine, where the queries earn their keep.

Genuine bugs found in that code are fixed on their own, independent of scanning.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Signed-off-by: Xavier Roche <roche@httrack.com>

.github/workflows/codeql.yml

@@ -46,6 +46,12 @@ jobs:
           # fopen's umask-controlled 0666 is intended for mirror/cache/log
           # output; the one credential file (cookies.txt) is kept 0600 on Unix.
           config: |
+            paths-ignore:
+              # Demo callback samples, not part of libhttrack.
+              - libtest
+              # ProxyTrack: a separate legacy binary with no auth surface; its
+              # recv/cache-parse code trips taint queries by design.
+              - src/proxy
             query-filters:
               - exclude:
                   id: cpp/world-writable-file-creation

fuzz/Makefile.am

@@ -39,6 +39,7 @@ EXTRA_DIST = README.md run-fuzzers.sh \
 	corpus/filters/filter.bin corpus/filters/filter-size.bin \
 	corpus/filters/regress-empty-subject-unique.bin \
 	corpus/filters/redos-star-classes.bin \
+	corpus/filters/regress-classdepth-timeout.bin \
 	corpus/url/http-url.txt corpus/url/relative-path.txt \
 	corpus/url/regress-file-empty-path.txt corpus/url/regress-long-path-abort.txt \
 	corpus/header/full-response.txt corpus/header/redirect.txt \

src/htsfilters.c

@@ -154,12 +154,14 @@ static const char *strjoker_rec(strjoker_memo *memo, const char *chaine,
 
   if (depth > memo->maxdepth)
     memo->maxdepth = depth;
+  /* Charge the budget before the depth cap: cut disables the memo, so uncounted
+     deep calls would let the sub-cap search explode (OSS-Fuzz 535114376). */
+  if (memo->nsteps != NULL && ++*memo->nsteps > STRJOKER_MAXSTEPS)
+    return NULL; /* work budget spent: fail the match safely */
   if (depth >= STRJOKER_MAXDEPTH) {
     memo->cut = HTS_TRUE;
     return NULL; /* nesting beyond any real filter: fail the branch safely */
   }
-  if (memo->nsteps != NULL && ++*memo->nsteps > STRJOKER_MAXSTEPS)
-    return NULL; /* work budget spent: fail the match safely */
   if (memo->failed) {
     bit = (size_t) (chaine - memo->chaine0) * memo->stride +
           (size_t) (joker - memo->joker0);

src/htsselftest.c

@@ -794,6 +794,20 @@ static int st_filterbounds(httrackp *opt, int argc, char **argv) {
   memset(subj, 'a', 32);
   subj[32] = '\0';
   assertf(strjoker(subj, pat, NULL, NULL) != NULL);
+  /* Same pin for the class-branch shape users actually write (*[..]), against a
+     long subject: it must match with room to spare under the work cap. */
+  {
+    const char *seg = "*[A-Z,a-z,0-9]";
+    const size_t seglen = strlen(seg), nseg = 16;
+
+    for (i = 0; i < (int) nseg; i++)
+      memcpy(pat + i * seglen, seg, seglen);
+    pat[nseg * seglen] = '\0';
+    memset(subj, 'a', 512);
+    subj[512] = '\0';
+    assertf(strjoker_bounds(subj, pat, &steps, &maxsteps, NULL, NULL) != NULL);
+    assertf(steps < maxsteps);
+  }
   freet(pat);
   freet(subj);
   printf("filterbounds: OK\n");