Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Resolve CodeQL alert 44 #6481

Closed
12 of 15 tasks
Tracked by #5159
roslynwythe opened this issue Mar 20, 2024 · 4 comments · Fixed by #6542
Closed
12 of 15 tasks
Tracked by #5159

Resolve CodeQL alert 44 #6481

roslynwythe opened this issue Mar 20, 2024 · 4 comments · Fixed by #6542
Assignees
Labels
Complexity: Medium Feature: Code Alerts role: back end/devOps Tasks for back-end developers role: front end Tasks for front end developers size: 1pt Can be done in 4-6 hours
Milestone

Comments

@roslynwythe
Copy link
Member

roslynwythe commented Mar 20, 2024

Prerequisite

  1. Be a member of Hack for LA. (There are no fees to join.) If you have not joined yet, please follow the steps on our Getting Started page.
  2. Before you claim or start working on an issue, please make sure you have read our How to Contribute to Hack for LA Guide.

Overview

As developers. we need to analyze CodeQL query alert 44 and either recommend dismissal of the alert or update the code to resolve the alert.

Action Items

  • DO NOT DISMISS ANY ALERTS. Dismissal of alerts should be done by dev leads only after review of the recommendation
  • Browse to the link in the next Action Item and read the contents. Click "See More" to view Recommendations, Examples and References.
  • https://github.com/hackforla/website/security/code-scanning/44
  • Note that the same problem may exist in several locations within a code file. Only update the section of code indicated in the alert detail page.
  • Note these resources:
    • See the wiki page "How to manage CodeQL alerts" (see under Resources)
    • To look at the resolution of similar alerts, visit the code scanning page and query closed alerts for similar alert type. To see the resolution of a closed alert, view the alert details and open the tracking issue (outlined in red in the screenshot under Resources)
  • In a comment in this issue, provide your recommendation. The recommendation can be one of the following: dismiss as test, dismiss as false positive, dismiss as won't fix, or update code. An example of a 'false positive' is a report of a JavaScript syntax error that is caused by markdown or liquid symbols such as --- or {%.
  • If the recommendation is to update code:
    • create an issue branch and proceed with the code update
    • Use docker to test locally, ensuring that there are no changes to any affected webpage(s)
    • proceed with pull request in the usual manner
  • If the recommendation is to dismiss, describe your reason for dismissal in the comment, then move the issue to Questions/In Review and apply the label ready for dev lead.

For merge team/dev lead

Resources/Instructions

Screenshot of CodeQL alert detail page with tracking issue outlined in red

CodeQLAlert

@roslynwythe roslynwythe added Feature Missing This label means that the issue needs to be linked to a precise feature label. size: missing role missing Complexity: Missing labels Mar 20, 2024

This comment was marked as outdated.

@roslynwythe roslynwythe added Complexity: Medium role: front end Tasks for front end developers role: back end/devOps Tasks for back-end developers size: 1pt Can be done in 4-6 hours Feature: Code Alerts Ready for Prioritization and removed Feature Missing This label means that the issue needs to be linked to a precise feature label. size: missing role missing Complexity: Missing labels Mar 20, 2024
@ExperimentsInHonesty ExperimentsInHonesty added this to the 02. Security milestone Mar 24, 2024
@ramitaarora ramitaarora self-assigned this Mar 24, 2024
Copy link

Hi @ramitaarora, thank you for taking up this issue! Hfla appreciates you :)

Do let fellow developers know about your:-
i. Availability: (When are you available to work on the issue/answer questions other programmers might have about your issue?)
ii. ETA: (When do you expect this issue to be completed?)

You're awesome!

P.S. - You may not take up another issue until this issue gets merged (or closed). Thanks again :)

@ramitaarora
Copy link
Member

ramitaarora commented Mar 24, 2024

i. Availability: Weekdays 9am-12pm
ii. ETA: Mar 28 EoD

@ramitaarora
Copy link
Member

Recommendation to fix CodeQL: update code

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
Complexity: Medium Feature: Code Alerts role: back end/devOps Tasks for back-end developers role: front end Tasks for front end developers size: 1pt Can be done in 4-6 hours
Development

Successfully merging a pull request may close this issue.

3 participants