From 454430a057a4c2a11f956a41ceaf65d0a86650d8 Mon Sep 17 00:00:00 2001
From: Nick Craig-Wood <nick@craig-wood.com>
Date: Thu, 16 Jul 2026 14:47:03 +0100
Subject: [PATCH] combine: don't return an error message as the remote name for
 a bad object

This fixes 30 spurious CodeQL path-injection alerts which used the
error message as a taint path from HTTP responses into filesystem
paths.
---
 backend/combine/combine.go | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/backend/combine/combine.go b/backend/combine/combine.go
index 6c74c343f..bea73472a 100644
--- a/backend/combine/combine.go
+++ b/backend/combine/combine.go
@@ -1104,7 +1104,7 @@ func (o *Object) Remote() string {
 	newPath, err := o.u.pathAdjustment.do(o.Object.String())
 	if err != nil {
 		fs.Errorf(o.Object, "Bad object: %v", err)
-		return err.Error()
+		return ""
 	}
 	return newPath
 }