From da72244c2d760d6fcb852e7cbe70f5621e311747 Mon Sep 17 00:00:00 2001
From: Gigi <42325924+g-cqd@users.noreply.github.com>
Date: Wed, 5 Aug 2026 23:20:31 +0200
Subject: [PATCH] fix(fuzz): drop a statically dead null guard in the markdown
 oracle
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

CodeQL #128 (js/comparison-between-incompatible-types): extractFrontmatter
returns an object literal on every path, so `result == null` can never be
true and the comparison is dead.

It also bought nothing. Had it ever returned null, the property reads that
follow would throw a TypeError, which the fuzzer reports as a crash exactly
the same way. The assertions that carry the contract — body is a string,
body is never longer than the input, a declined parse leaves the body
untouched — are unchanged.

Re-fuzzed after the edit: 610,641 executions, no crashes.
---
 fuzz/fuzz-markdown.js | 8 +++++---
 1 file changed, 5 insertions(+), 3 deletions(-)

diff --git a/fuzz/fuzz-markdown.js b/fuzz/fuzz-markdown.js
index 41faf70a..d82d835b 100644
--- a/fuzz/fuzz-markdown.js
+++ b/fuzz/fuzz-markdown.js
@@ -15,9 +15,11 @@ export function fuzz(data) {
   const text = data.toString('utf8')
   const result = extractFrontmatter(text)
 
-  if (result == null || typeof result !== 'object') {
-    throw new Error(`extractFrontmatter returned ${JSON.stringify(result)}`)
-  }
+  // No explicit null/shape guard: extractFrontmatter returns an object
+  // literal on every path, so CodeQL correctly flags `result == null` as
+  // statically dead (js/comparison-between-incompatible-types). It also buys
+  // nothing — were it ever to return null, the property reads below throw a
+  // TypeError, which the fuzzer reports as a crash just the same.
   if (typeof result.body !== 'string') {
     throw new Error(`body is not a string: ${JSON.stringify(result.body)}`)
   }