Use fstatSync(fd) to avoid OOM w/ searchFile

Author: data-douser

.github/instructions/server_src_ts.instructions.md

@@ -24,13 +24,9 @@ This file contains instructions for working with TypeScript source code files in
 - PREFER the import of functionality from `@modelcontextprotocol/sdk` over direct implementation, unless absolutely necessary.
 - PREFER to implement each MCP server primitive in its own file named after the primitive, e.g., `server/src/<lib-example>/<primitive-example>.ts`.
 - PREFER many simple MCP server primitives that each do one thing well over fewer complex MCP server primitives that do many things.
-- PREFER copying and/or adapting existing `*.prompt.md` files matching one of the following patterns:
-  - `ql/.github/prompts/*.prompt.md`
-  - `ql/languages/*/tools/dev/*.prompt.md`
-  - `ql/resources/{codeql,qlt}/*.prompt.md`
 
 ## CONTRAINTS
 
 - NEVER leave any trailing whitespace on any line.
-- NEVER guess at what a `codeql` or `qlt` CLI subcommand does; ALWAYS verify against the official `codeql <subcommand> -h -vv` or `qlt <subcommand> -h` documentation, respectively.
+- NEVER guess at what a `codeql` CLI subcommand does; ALWAYS verify against the official `codeql <subcommand> -h -vv` documentation.
 - **NEVER use stat/lstat followed by a separate read/open on the same path** — this is a TOCTOU (Time-of-Check-Time-of-Use) race condition (CWE-367). Instead, attempt the operation directly (e.g., `readFileSync`) within a try/catch block. If you need to know the file size before reading, read first and then check the buffer size — do NOT stat then read. For directory traversal, `lstatSync` is acceptable since it is the operation itself (checking entry type), not a precursor to a separate operation.

server/dist/codeql-development-mcp-server.js

@@ -62913,7 +62913,7 @@ var codeqlResolveTestsTool = {
 };
 
 // src/tools/codeql/search-ql-code.ts
-import { createReadStream as createReadStream3, lstatSync, readdirSync as readdirSync8, readFileSync as readFileSync9, realpathSync } from "fs";
+import { closeSync, createReadStream as createReadStream3, fstatSync, lstatSync, openSync, readdirSync as readdirSync8, readFileSync as readFileSync9, realpathSync } from "fs";
 import { basename as basename6, extname as extname2, join as join15, resolve as resolve9 } from "path";
 import { createInterface as createInterface3 } from "readline";
 init_logger();
@@ -62968,14 +62968,38 @@ function collectFiles(paths, extensions, fileCount) {
   return files;
 }
 async function searchFile(filePath, regex, contextLines, maxCollect) {
+  let fd;
+  try {
+    fd = openSync(filePath, "r");
+  } catch {
+    return { matches: [], totalCount: 0 };
+  }
+  let size;
+  try {
+    size = fstatSync(fd).size;
+  } catch {
+    try {
+      closeSync(fd);
+    } catch {
+    }
+    return { matches: [], totalCount: 0 };
+  }
+  if (size > MAX_FILE_SIZE_BYTES) {
+    return searchFileStreaming(filePath, regex, contextLines, maxCollect, fd);
+  }
   let content;
   try {
-    content = readFileSync9(filePath, "utf-8");
+    content = readFileSync9(fd, "utf-8");
   } catch {
+    try {
+      closeSync(fd);
+    } catch {
+    }
     return { matches: [], totalCount: 0 };
   }
-  if (Buffer.byteLength(content, "utf-8") > MAX_FILE_SIZE_BYTES) {
-    return searchFileStreaming(filePath, regex, contextLines, maxCollect);
+  try {
+    closeSync(fd);
+  } catch {
   }
   const lines = content.replace(/\r\n/g, "\n").split("\n");
   const matches = [];
@@ -63001,19 +63025,31 @@ async function searchFile(filePath, regex, contextLines, maxCollect) {
   }
   return { matches, totalCount };
 }
-async function searchFileStreaming(filePath, regex, contextLines, maxCollect) {
+async function searchFileStreaming(filePath, regex, contextLines, maxCollect, fd) {
   const matches = [];
   const recentLines = [];
   const pending = [];
   let lineNumber = 0;
   let totalCount = 0;
   let rl;
   try {
+    const streamOpts = { encoding: "utf-8" };
+    if (fd !== void 0) {
+      streamOpts.fd = fd;
+      streamOpts.autoClose = true;
+      streamOpts.start = 0;
+    }
     rl = createInterface3({
-      input: createReadStream3(filePath, { encoding: "utf-8" }),
+      input: createReadStream3(filePath, streamOpts),
       crlfDelay: Infinity
     });
   } catch {
+    if (fd !== void 0) {
+      try {
+        closeSync(fd);
+      } catch {
+      }
+    }
     return { matches: [], totalCount: 0 };
   }
   for await (const line of rl) {