mirror of
https://github.com/okieselbach/AutopilotMonitor.git
synced 2026-10-24 20:53:06 +00:00
Oliver Kieselbach
fa640ebe61
Bucket B (real fixes) + Bucket A (config) of the CodeQL alert triage. Log-forging (cs/log-forging, 8 sinks): add Helpers/LogSanitizer that strips CR/LF and other control characters, and apply it to the logged copy of every user-controlled value in AuthenticationMiddleware, PolicyEnforcementMiddleware (Invoke + DecideAsync), McpQuotaEnforcementMiddleware and TableUserUsageRepository. Only the logged value is sanitized — routing, authorization and storage keys are untouched, so tracing fidelity for legitimate values (paths, UPNs, GUIDs) is preserved. Structured logging already isolated the fields; this closes the CRLF vector as defense-in-depth and clears the query. Three genuine JS/TS fixes: - guardValidation.ts: replace the no-op `.replace(/%/g, "%")` with a real escapeRegExp() — the author intended to escape; this also closes the latent metacharacter gap (js/identity-replacement). - access-guard.ts: use a `%s` format argument instead of interpolating the UPN into the console.error format string (js/tainted-format-string). - docs-corpus.ts: strip HTML tags with a loop-until-stable stripHtmlTags() so the sanitizer is robust and recognized as complete (js/incomplete-multi-char-sanitization). CodeQL config: filter the two queries that fire structurally on this codebase, where the flagged behavior is the feature — cs/exposure-of-sensitive-information (audit/notification logs legitimately record the actor UPN / recipient email) and cs/cleartext-storage-of-sensitive-information (rate limiters key on the trusted client IP). Default suites stay active; genuine one-off false positives from other queries are dismissed individually so those queries stay sharp. Tests: Backend xUnit 3110 (+9 LogSanitizer), MCP vitest 19 (+1 tag-strip), Web vitest 49, all tsc clean. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
32 lines
1.5 KiB
YAML
32 lines
1.5 KiB
YAML
# CodeQL configuration.
|
|
#
|
|
# The default query suites stay active — this file only filters out two C# queries
|
|
# that fire structurally on this codebase, where the flagged behavior is the feature,
|
|
# not a defect:
|
|
#
|
|
# cs/exposure-of-sensitive-information
|
|
# Audit and operational logs record WHO performed an action (actor UPN / email)
|
|
# and notification services deliver mail to a recipient address. Writing that
|
|
# identity to the log / notification IS the purpose of the field. Every such site
|
|
# is a legitimate, reviewed use — the query cannot distinguish it from a leak.
|
|
#
|
|
# cs/cleartext-storage-of-sensitive-information
|
|
# The rate limiters and distress guard use the trusted client IP as their bucket
|
|
# key. The IP is an identifier for throttling, not a secret at rest; storing it in
|
|
# the in-memory / table rate-limit key is by design.
|
|
#
|
|
# Genuine one-off false positives from OTHER queries (e.g. an open-redirect the taint
|
|
# model can't see is allow-listed, a rate-limited route it doesn't recognize) are
|
|
# dismissed individually in the Security tab so those queries stay sharp — they are
|
|
# NOT suppressed here.
|
|
#
|
|
# Log-injection (cs/log-forging) is deliberately NOT filtered: user-controlled values
|
|
# are sanitized at the sink via Helpers/LogSanitizer, so the query stays useful for
|
|
# catching a future unsanitized sink.
|
|
|
|
query-filters:
|
|
- exclude:
|
|
id: cs/exposure-of-sensitive-information
|
|
- exclude:
|
|
id: cs/cleartext-storage-of-sensitive-information
|