Create Issues for Analysis of CodeQL alerts

[roslynwythe]

Dependency

• Epic: Manage CodeQL deployment #5005 is ready for implementation

Analysis Issues

• Epic: Create issues to resolve CodeQL alerts 1- 24, 98 "Potentially unsafe external link" #5129
• Resolve CodeQL alert 25 #5642
• Resolve CodeQL alerts 36 and 37 #5660
• Resolve CodeQL alert 39 missing variable declaration #5666
• Here the code is not in production so not sure if we should proceed Resolve CodeQL alert 39 missing variable declaration #5666
• Resolve CodeQL Alert 41: Missing variable declaration #5706
• Inclusion of functionality from an untrusted source
• Superfluous trailing arguments
• Malformed id
• Resolve CodeQL query alert 56 #5473
• Missing variable declaration
• Unused variable, import, function or class
• Syntax error
• Semicolon insertion

Overview

We need to create issues for the analysis of CodeQL alerts¹ so that information in the alerts can be used to improve the security and quality of the codebase.

Action Items

• create a template for an issue that calls for analysis and recommendation on the disposition of a one or two alerts. If the recommendation is to update code, then after review, work on the issue will proceed with the code update. - see Create Issues for Analysis of CodeQL alerts #5060 (comment)
• In some cases where there are a number of similar alerts, a slightly different issue template will be required in which after a recommendation to update code is approved, the assignee will create the issues to update the code. see Epic: Create issues to resolve CodeQL alerts 1- 24, 98 "Potentially unsafe external link" #5129

Resources/Instructions

• This issue is part of Epic: Manage CodeQL deployment #5005

Footnotes

1. Code scanning results page ↩

[roslynwythe]

TEMPLATE: Resolve CodeQL Alert INSERT-ALERT-ID

Prerequisite

1. Be a member of Hack for LA. (There are no fees to join.) If you have not joined yet, please follow the steps on our Getting Started page.
2. Before you claim or start working on an issue, please make sure you have read our How to Contribute to Hack for LA Guide.

Overview

We need to analyze CodeQL query alert INSERT-ALERT-ID then either recommend dismissal of the alert or update the code to resolve the alert.

Action Items

• DO NOT DISMISS ANY ALERTS. Dismissal of alerts should be done by dev leads only after review of the recommendation
• Browse to the link in the next Action Item and read the contents. Click "See More" to view Recommendations, Examples and References.
• https://github.com/hackforla/website/security/code-scanning/INSERT-ALERT-ID
• In a comment in this issue, add your analysis and recommendations. The recommendation can be one of the following: dismiss as test, dismiss as false positive, dismiss as won't fix, or update code. An example of a false positive is a report of a JavaScript syntax error that is caused by markdown or liquid symbols such as --- or {%
• If the recommendation is to dismiss the alert, apply the label ready for dev lead then move the issue to Questions/In Review
• If the recommendation is to update code:
  • create an issue branch and proceed with the code update
  • test using docker to ensure that there are no changes to any affected webpage(s)
  • proceed with pull request in the usual manner

For merge team/dev lead

• If recommendation to dismiss is approved, dismiss the alert with a comment, then close the issue as completed.
• If recommendation to update code is approved, move the issue to "In Progress", remove "ready for dev lead" label and notify assignee to proceed
• In either case when this issue is closed please check off the dependency (under "Analysis Issues") in Create Issues for Analysis of CodeQL alerts #5060. If all analysis issues are closed, close Create Issues for Analysis of CodeQL alerts #5060 as completed.

Resources/Instructions

• GitHub CodeQL documentation
• This issue is part of Create Issues for Analysis of CodeQL alerts #5060

[roslynwythe]

• This issue is no longer needed because all required issues will be created from Epic: Manage CodeQL deployment #5005. In most cases, we don't require separate issues for analysis and for resolving the alerts, rather the analysis and code fix will be completed in a single issue, with the exception of a few alert queries.