From 0dcf309c48e527bbe82237ba0e440c86c9b4c8fb Mon Sep 17 00:00:00 2001 From: Anso Date: Wed, 6 May 2026 08:47:34 -0400 Subject: [PATCH] fix: add CodeQL barrier model for sanitizeForLog against log injection (#935) sanitizeForLog() already strips CR, LF, and control characters from user input before logging, but CodeQL did not recognize the custom sanitizer. This caused false-positive log-injection alerts at every call site. Add a CodeQL data extension model that marks the return value of sanitizeForLog() as a barrier against log-injection taint, and a codeql-config.yml that references it. --- .github/codeql/codeql-config.yml | 2 ++ .github/codeql/extensions/safeLog.model.yml | 6 ++++++ .github/workflows/codeql.yml | 1 + 3 files changed, 9 insertions(+) create mode 100644 .github/codeql/codeql-config.yml create mode 100644 .github/codeql/extensions/safeLog.model.yml diff --git a/.github/codeql/codeql-config.yml b/.github/codeql/codeql-config.yml new file mode 100644 index 00000000..7898293e --- /dev/null +++ b/.github/codeql/codeql-config.yml @@ -0,0 +1,2 @@ +data_extensions: + - .github/codeql/extensions/safeLog.model.yml diff --git a/.github/codeql/extensions/safeLog.model.yml b/.github/codeql/extensions/safeLog.model.yml new file mode 100644 index 00000000..04eec809 --- /dev/null +++ b/.github/codeql/extensions/safeLog.model.yml @@ -0,0 +1,6 @@ +extensions: + - addsTo: + pack: codeql/javascript-all + extensible: barrierModel + data: + - ["backend/src/utils/safeLog", "Member[sanitizeForLog].ReturnValue", "log-injection"] diff --git a/.github/workflows/codeql.yml b/.github/workflows/codeql.yml index da54f251..b756f9d8 100644 --- a/.github/workflows/codeql.yml +++ b/.github/workflows/codeql.yml @@ -37,6 +37,7 @@ jobs: with: languages: ${{ matrix.language }} queries: security-extended + config-file: .github/codeql/codeql-config.yml - name: Autobuild uses: github/codeql-action/autobuild@95e58e9a2cdfd71adc6e0353d5c52f41a045d225 # v4.35.2