From 42c4a9d39664e1abec66f428c99528b84b419dde Mon Sep 17 00:00:00 2001 From: "Jose I. Paris" Date: Wed, 28 Oct 2026 16:51:50 +0100 Subject: [PATCH] ci(codeql): honor alert suppression comments CodeQL reported two false positives: the cookie in casredirect.go is Secure except in development mode, and the quoted string in redaction.go is escaped and only decoded as JSON. A `// codeql[]` comment marks an alert as suppressed in the SARIF only when the alert suppression query runs, and the default queries do not include it. Run codeql/go-queries:AlertSuppression.ql next to the default queries, and add a suppression comment with the reason for each false positive. Refs: PFM-8051 Assisted-by: Claude Code Signed-off-by: Jose I. Paris Chainloop-Trace-Sessions: 6ef5e9f5-dc0c-45cf-8b3f-70d112a87b7e --- .github/workflows/codeql.yml | 3 +++ app/controlplane/internal/service/casredirect.go | 1 + internal/redaction/redaction.go | 1 + 3 files changed, 5 insertions(+) diff --git a/.github/workflows/codeql.yml b/.github/workflows/codeql.yml index 0b768bbb9..b8ba876c1 100644 --- a/.github/workflows/codeql.yml +++ b/.github/workflows/codeql.yml @@ -59,6 +59,9 @@ jobs: uses: github/codeql-action/init@6a28655e3dcb49cb0840ea372fd6d17733edd8a4 # v2.21.8 with: languages: ${{ matrix.language }} + # The alert suppression query marks the alerts that a `// codeql[]` + # comment covers with a SARIF suppressions field. The default queries still run. + packs: codeql/go-queries:AlertSuppression.ql - name: Autobuild uses: github/codeql-action/autobuild@6a28655e3dcb49cb0840ea372fd6d17733edd8a4 # v2.21.8 diff --git a/app/controlplane/internal/service/casredirect.go b/app/controlplane/internal/service/casredirect.go index c49e08ecb..e003052cb 100644 --- a/app/controlplane/internal/service/casredirect.go +++ b/app/controlplane/internal/service/casredirect.go @@ -308,5 +308,6 @@ func (s *CASRedirectService) setDownloadVerifierCookie(w http.ResponseWriter, fl cookie.MaxAge = -1 cookie.Expires = time.Unix(1, 0) } + // codeql[go/cookie-secure-not-set] Secure is true, and false only in development mode. http.SetCookie(w, cookie) } diff --git a/internal/redaction/redaction.go b/internal/redaction/redaction.go index cd0687f9f..c800f9e8a 100644 --- a/internal/redaction/redaction.go +++ b/internal/redaction/redaction.go @@ -597,6 +597,7 @@ func (w *rewriter) redactLeaf(s, path string) string { w.count += n var out string + // codeql[go/unsafe-quoting] body is escaped by encodeStringBody, and the sink is a JSON decode. if err := json.Unmarshal([]byte(`"`+body+`"`), &out); err != nil { // A replacement cut through a JSON escape sequence. Drop the whole leaf // rather than risk leaving part of the secret behind.