ER: CodeQL did not raise alerts on each instance of "Potentially unsafe external link"
- Dominant language
- JavaScript
- Stars
- 363
- Forks
- 872
- Avg merge
- 2d 21h
- Merged PRs (30d)
- 18
Description
### Dependencies
The issue could be resolved with:
- #6548
### Emergent Requirement - Problem
- The file `_includes/current_guides.html` contained two instances of "Potentially unsafe external links" but only one CodeQL alert was raised.
- The file `_includes/about-page/about-card-sponsors` contained four instance of ""Potentially unsafe external links" but only one CodeQL alert was raised
### Details
Regarding `_includes/current_guides.html`:
- The first instance is on line 77 as detailed in https://github.com/hackforla/website/security/code-scanning/3
- The second instance is on line 80. No CodeQL alert was found addressing this instance and so #6484 was created
### Issue you discovered this emergent requirement in
- #6044
### Date discovered
3/4/2024
### Did you have to do something temporarily
- [x] YES #6484 was created
- [ ] NO
### Who was involved
@djbradleyii
### What happens if this is not addressed
code security/quality issues may be missed
### Resources
### Recommended Action Items
- [ ] Make a new issue
- [ ] Discuss with team
- [ ] Let a Team Lead know
### Potential solutions [draft]
- We are aware that CodeQL runs into errors scanning Javascript code files with liquid statements. In both files in which CodeQL failed to report errors, liquid code was found. Therefore I suggest putting this ER on hold, with a dependency on #6387
- Search/audit the codebase for any other instances of "Potentially unsafe external link" that are not detected by CodeQL
- resarch to determine possible reasons why CodeQL did not create an alert for this instance of "Potentially unsafe external link"
Contributor guide
Assessment
This issue has not been assessed yet.