microsoft / microsoft/viva-insights-sample-code
CodeQL flags vendored JS in self-contained flexdashboard HTML reports (pre-existing, 88 open alerts on main)
@martinctc is already working on this.
Since Sep 17, 2026.
- #23 by @copilot-swe-agent — closed without merging
- Dominant language
- R
- Stars
- 15
- Forks
- 3
- Avg merge
- 3d 11h
- Merged PRs (30d)
- 10
Description
Summary
CodeQL's default JS/TS analysis flags the vendored JavaScript that R Markdown / flexdashboard bundles into self-contained .html report outputs under examples/utility-r/. These are library internals (jQuery, Bootstrap, DataTables plugins pulled in by flexdashboard/rmarkdown when self_contained: true), not code authored in this repo, and the reports are static files with no attacker-controlled input.
This already affects main today - it is not specific to any one PR.
Evidence
Open code-scanning alerts on main (checked via gh api repos/microsoft/viva-insights-sample-code/code-scanning/alerts?ref=refs/heads/main): 88 open alerts, all on previously-merged .Rmd -> self-contained .html reports:
| File | Rules |
|---|---|
examples/utility-r/event-study-did.html |
js/xss-through-dom, js/unsafe-jquery-plugin |
examples/utility-r/did-metric-scan.html |
js/xss-through-dom, js/unsafe-jquery-plugin |
examples/utility-r/copilot-usage-segments-trend.html |
js/xss-through-dom, js/unsafe-jquery-plugin |
PR #17 adds two more reports built the same way and picks up the same alert types on the new files (30 new alerts: 18 high, 12 medium), which is what surfaces as a failing CodeQL check on that PR.
CodeQL is running via default setup (gh api repos/microsoft/viva-insights-sample-code/code-scanning/default-setup): languages actions, javascript, javascript-typescript, python, ruby, typescript, default query suite, weekly schedule. There is no repo-committed CodeQL workflow, so exclusions currently can only be configured in Settings > Code security > CodeQL analysis, not via a file in this repo.
Proposed fix
One of:
- Path exclusion under default setup - exclude
examples/**/*.html(and any other pre-rendered report output paths) from JS/TS analysis in the repo's CodeQL settings. Lowest effort, no workflow file needed. - Switch to advanced setup with a checked-in
.github/workflows/codeql.ymlthat setspaths-ignorefor rendered report HTML. More visible/reviewable in-repo, but is a bigger change to how CodeQL runs for the whole repo.
Either way, the intent is the same: stop CodeQL from analysing generated, self-contained report HTML as if it were first-party application JavaScript, while continuing to scan actual source (.R, .Rmd code chunks, .py, .js/.ts, Actions workflows) normally.
Non-goals
- Not proposing to touch any actual first-party source in this issue.
- Not proposing to suppress CodeQL entirely - only to scope out generated report HTML.
References
Contributor guide
No contributing guide indexed for this repository
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Assessment
This issue has not been assessed yet.