mirror of
https://github.com/okieselbach/AutopilotMonitor.git
synced 2026-10-24 12:42:38 +00:00
Oliver Kieselbach
b6791d37e0
The query recognizes only npm limiter packages, never oauthRateLimit / oauthTokenRateLimit, and flags a handler as soon as it calls a function named like *auth*, *login* or *verify*. All six alerts it ever raised were on throttled OAuth routes (the last two came from tenantAuthority()). What it stood in for is now a test: every route of the OAuth router must run a per-IP limiter first unless it is one of the three named discovery documents, /oauth/token must carry the strict budget, and a router.use() middleware fails the check. Verified by mutation: removing the limiter from /oauth/authorize fails the test with the route name. Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
44 lines
2.3 KiB
YAML
44 lines
2.3 KiB
YAML
# CodeQL configuration.
|
|
#
|
|
# The default query suites stay active — this file only filters out queries that
|
|
# fire structurally on this codebase, where the flagged behavior is the feature
|
|
# or the protection exists in a form the query cannot see:
|
|
#
|
|
# cs/exposure-of-sensitive-information
|
|
# Audit and operational logs record WHO performed an action (actor UPN / email)
|
|
# and notification services deliver mail to a recipient address. Writing that
|
|
# identity to the log / notification IS the purpose of the field. Every such site
|
|
# is a legitimate, reviewed use — the query cannot distinguish it from a leak.
|
|
#
|
|
# cs/cleartext-storage-of-sensitive-information
|
|
# The rate limiters and distress guard use the trusted client IP as their bucket
|
|
# key. The IP is an identifier for throttling, not a secret at rest; storing it in
|
|
# the in-memory / table rate-limit key is by design.
|
|
#
|
|
# js/missing-rate-limiting
|
|
# Only the MCP server has Express routes. Every one that does work is throttled by
|
|
# our own limiters (oauthRateLimit / oauthTokenRateLimit on /oauth/*, accessGuard
|
|
# on /mcp); /health and the OAuth discovery documents return static JSON.
|
|
# The query only recognizes limiters from npm packages (express-rate-limit and
|
|
# similar) and flags a route handler as soon as it calls a function named
|
|
# like *auth*, *login* or *verify*. So it reports throttled and unthrottled
|
|
# routes the same way, and every alert it ever raised was a false positive. The
|
|
# coverage check it stood in for is a test: every OAuth router route must carry
|
|
# a limiter or be named as exempt (MCP oauth-rate-limit.test.ts).
|
|
#
|
|
# Genuine one-off false positives from OTHER queries (e.g. an open-redirect the taint
|
|
# model can't see is allow-listed) are dismissed individually in the Security tab so
|
|
# those queries stay sharp — they are NOT suppressed here.
|
|
#
|
|
# Log-injection (cs/log-forging) is deliberately NOT filtered: user-controlled values
|
|
# are sanitized at the sink via Helpers/LogSanitizer, so the query stays useful for
|
|
# catching a future unsanitized sink.
|
|
|
|
query-filters:
|
|
- exclude:
|
|
id: cs/exposure-of-sensitive-information
|
|
- exclude:
|
|
id: cs/cleartext-storage-of-sensitive-information
|
|
- exclude:
|
|
id: js/missing-rate-limiting
|