mirror of
https://github.com/Studio-Saelix/sencho.git
synced 2026-07-26 20:00:08 +00:00
Anso
86bfc108ae
Re-establish the path-containment barrier inline at the backup readdir sink in restoreStackFiles. The sink previously built backupDir through the getBackupDir helper, whose stack-name validation the static analyzer does not trace, leaving a flagged path-injection sink. The barrier now resolves backupDir against its root and asserts containment inline, the same pattern already used in backupStackFiles. Behavior is unchanged for valid stack names (already validated one line above by resolveStackDir). Scope the js/insecure-temporary-file rule out of e2e/** in the CodeQL config. End-to-end fixtures must seed files into the backend's COMPOSE_DIR so the API under test can read them back; that path is a fixed location under /tmp in both CI and local dev, which the rule flags. A randomized temp directory does not apply because the backend resolves against its own COMPOSE_DIR. Production code is still analyzed.
29 lines
1.4 KiB
YAML
29 lines
1.4 KiB
YAML
data_extensions:
|
|
- .github/codeql/extensions/safeLog.model.yml
|
|
|
|
query-filters:
|
|
# API tokens are 256-bit CSPRNG random; sha256 of the raw token is the
|
|
# correct construction. js/insufficient-password-hash exists to catch weak
|
|
# hashing of low-entropy human passwords, which is irrelevant for these
|
|
# high-entropy opaque keys. Scoped to the token-handling files only, so
|
|
# real user-password code (bcrypt-hashed elsewhere) is still analyzed.
|
|
- exclude:
|
|
id: js/insufficient-password-hash
|
|
paths:
|
|
- backend/src/utils/apiTokenFormat.ts
|
|
- backend/src/routes/apiTokens.ts
|
|
- backend/src/__tests__/**
|
|
# End-to-end fixtures seed files directly into the backend's COMPOSE_DIR so
|
|
# the API under test can read them back. Both the test runner and the backend
|
|
# use a fixed path under /tmp (the spec fallback and the CI start-app default
|
|
# are both /tmp/compose), so CodeQL flags the hardcoded literal as
|
|
# js/insecure-temporary-file. A randomized mkdtemp does not apply here: the
|
|
# backend resolves paths against its own COMPOSE_DIR, so a fixture written
|
|
# elsewhere would be invisible to it. The predictable-temp-path threat is also
|
|
# moot on the ephemeral, single-tenant machines these specs run on.
|
|
# Scoped to e2e/** so production code is still analyzed.
|
|
- exclude:
|
|
id: js/insecure-temporary-file
|
|
paths:
|
|
- e2e/**
|