hackforla / hackforla/website

ER: CodeQL did not raise alerts on each instance of "Potentially unsafe external link"

Open
#6,485 3 comments 0 reactions 0 assignees View on GitHub
Complexity: Missing Complexity: See issue making label Dependency ER Feature: Code Alerts manual dependency release role: back end/devOps size: 0.25pt
Dominant language
JavaScript
Stars
363
Forks
872
Avg merge
2d 21h
Merged PRs (30d)
18

Description

### Dependencies
The issue could be resolved with:
- #6548

### Emergent Requirement - Problem
- The file `_includes/current_guides.html` contained two instances of "Potentially unsafe external links" but only one CodeQL alert was raised.
- The file `_includes/about-page/about-card-sponsors` contained four instance of ""Potentially unsafe external links" but only one CodeQL alert was raised

### Details
Regarding `_includes/current_guides.html`:
- The first instance is on line 77 as detailed in https://github.com/hackforla/website/security/code-scanning/3
- The second instance is on line 80. No CodeQL alert was found addressing this instance and so #6484 was created

### Issue you discovered this emergent requirement in
- #6044

### Date discovered
3/4/2024

### Did you have to do something temporarily
- [x] YES #6484 was created
- [ ] NO

### Who was involved
@djbradleyii

### What happens if this is not addressed
code security/quality issues may be missed

### Resources

### Recommended Action Items
- [ ] Make a new issue
- [ ] Discuss with team
- [ ] Let a Team Lead know

### Potential solutions [draft]
- We are aware that CodeQL runs into errors scanning Javascript code files with liquid statements. In both files in which CodeQL failed to report errors, liquid code was found. Therefore I suggest putting this ER on hold, with a dependency on #6387
- Search/audit the codebase for any other instances of "Potentially unsafe external link" that are not detected by CodeQL
- resarch to determine possible reasons why CodeQL did not create an alert for this instance of "Potentially unsafe external link"

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.