Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Resolve CodeQL alert 15 "Potentially unsafe external link" #6049

Closed
6 tasks done
Tracked by #5129
roslynwythe opened this issue Jan 3, 2024 · 8 comments · Fixed by #6400
Closed
6 tasks done
Tracked by #5129

Resolve CodeQL alert 15 "Potentially unsafe external link" #6049

roslynwythe opened this issue Jan 3, 2024 · 8 comments · Fixed by #6400
Assignees
Labels
Feature: Code Alerts good first issue Good for newcomers P-Feature: Communities of Practice https://www.hackforla.org/communities-of-practice ready for dev lead Issues that tech leads or merge team members need to follow up on role: back end/devOps Tasks for back-end developers role: front end Tasks for front end developers size: 0.25pt Can be done in 0.5 to 1.5 hours
Milestone

Comments

@roslynwythe
Copy link
Member

roslynwythe commented Jan 3, 2024

Prerequisite

  1. Be a member of Hack for LA. (There are no fees to join.) If you have not joined yet, please follow the steps on our Getting Started page.
  2. Before you claim or start working on an issue, please make sure you have read our How to Contribute to Hack for LA Guide.

Overview

We need to resolve the alert "Potentially unsafe external link" which appears in the CodeQL alert 15 by adding the attribute rel="noopener noreferrer"

Action Items

  • The following item is required for GitHub to establish tracking between this issue and the alert. No action is required. You may simply check the checkbox. If you do follow the link to learn more about CodeQL alerts, DO NOT DISMISS THE ALERT.
  • https://github.com/hackforla/website/security/code-scanning/15
  • Open the file pages/communities-of-practice.html in your IDE
  • Replace
<a href="{{ community[1].links[1].url }}" class="btn btn-primary btn-md btn--default cop-btn" target="_blank"

with

<a href="{{ community[1].links[1].url }}" class="btn btn-primary btn-md btn--default cop-btn" target="_blank" rel="noopener noreferrer"
  • Using Docker, check the page remains the same in mobile, tablet, and desktop views as on the current website (See 2 in the Resources/Instructions section below)

Merge Team

Resources/Instructions

  1. GitHub CodeQL documentation
  2. Webpage: https://www.hackforla.org/communities-of-practice
  3. This issue is part of Epic: Create issues to resolve CodeQL alerts 1- 24, 98 "Potentially unsafe external link" #5129
@roslynwythe roslynwythe added Feature Missing This label means that the issue needs to be linked to a precise feature label. size: missing role missing Complexity: Missing labels Jan 3, 2024

This comment was marked as outdated.

@roslynwythe roslynwythe added good first issue Good for newcomers role: front end Tasks for front end developers role: back end/devOps Tasks for back-end developers P-Feature: Project Info and Page A project's detail page (e.g. https://www.hackforla.org/projects/100-automations) size: 0.25pt Can be done in 0.5 to 1.5 hours Feature: Code Alerts P-Feature: Communities of Practice https://www.hackforla.org/communities-of-practice Ready for Prioritization and removed P-Feature: Project Info and Page A project's detail page (e.g. https://www.hackforla.org/projects/100-automations) Feature Missing This label means that the issue needs to be linked to a precise feature label. size: missing role missing Complexity: Missing labels Jan 3, 2024
@ExperimentsInHonesty ExperimentsInHonesty added this to the 02. Security milestone Jan 23, 2024
@das-mittel das-mittel self-assigned this Feb 2, 2024
Copy link

github-actions bot commented Feb 2, 2024

Hi @das-mittel, thank you for taking up this issue! Hfla appreciates you :)

Do let fellow developers know about your:-
i. Availability: (When are you available to work on the issue/answer questions other programmers might have about your issue?)
ii. ETA: (When do you expect this issue to be completed?)

You're awesome!

P.S. - You may not take up another issue until this issue gets merged (or closed). Thanks again :)

@das-mittel
Copy link
Member

Availability: Tuesday 6th Feb to Thursday 8th Feb
ETA: Before or on Thursday 15th Jan. Next progress report to be given by end of Thursday 8th Feb

@roslynwythe roslynwythe added the ready for dev lead Issues that tech leads or merge team members need to follow up on label Feb 6, 2024
@github-actions github-actions bot added the To Update ! No update has been provided label Feb 16, 2024
Copy link

@das-mittel

Please add update using the below template (even if you have a pull request). Afterwards, remove the 'To Update !' label and add the 'Status: Updated' label.

  1. Progress: "What is the current status of your project? What have you completed and what is left to do?"
  2. Blockers: "Difficulties or errors encountered."
  3. Availability: "How much time will you have this week to work on this issue?"
  4. ETA: "When do you expect this issue to be completed?"
  5. Pictures (optional): "Add any pictures of the visual changes made to the site so far."

If you need help, be sure to either: 1) place your issue in the Questions/In Review column of the Project Board and ask for help at your next meeting, 2) put a "Status: Help Wanted" label on your issue and pull request, or 3) put up a request for assistance on the #hfla-site channel. Please note that including your questions in the issue comments- along with screenshots, if applicable- will help us to help you. Here and here are examples of well-formed questions.

You are receiving this comment because your last comment was before Monday, February 12, 2024 at 11:05 PM PST.

@github-actions github-actions bot added 2 weeks inactive An issue that has not been updated by an assignee for two weeks and removed To Update ! No update has been provided labels Feb 23, 2024
Copy link

@das-mittel

Please add update using the below template (even if you have a pull request). Afterwards, remove the '2 weeks inactive' label and add the 'Status: Updated' label.

  1. Progress: "What is the current status of your project? What have you completed and what is left to do?"
  2. Blockers: "Difficulties or errors encountered."
  3. Availability: "How much time will you have this week to work on this issue?"
  4. ETA: "When do you expect this issue to be completed?"
  5. Pictures (optional): "Add any pictures of the visual changes made to the site so far."

If you need help, be sure to either: 1) place your issue in the Questions/In Review column of the Project Board and ask for help at your next meeting, 2) put a "Status: Help Wanted" label on your issue and pull request, or 3) put up a request for assistance on the #hfla-site channel. Please note that including your questions in the issue comments- along with screenshots, if applicable- will help us to help you. Here and here are examples of well-formed questions.

You are receiving this comment because your last comment was before Monday, February 19, 2024 at 11:06 PM PST.

@ExperimentsInHonesty
Copy link
Member

@das-mittel I am removing you from this issue, since you have not provided an update for 3 weeks.

@ExperimentsInHonesty ExperimentsInHonesty removed the 2 weeks inactive An issue that has not been updated by an assignee for two weeks label Feb 29, 2024
@anthonypz anthonypz self-assigned this Feb 29, 2024
Copy link

Hi @anthonypz, thank you for taking up this issue! Hfla appreciates you :)

Do let fellow developers know about your:-
i. Availability: (When are you available to work on the issue/answer questions other programmers might have about your issue?)
ii. ETA: (When do you expect this issue to be completed?)

You're awesome!

P.S. - You may not take up another issue until this issue gets merged (or closed). Thanks again :)

@anthonypz
Copy link
Member

Availability: all day Thursday, Friday after 6 p.m.
ETA: By 8 p.m. Friday

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
Feature: Code Alerts good first issue Good for newcomers P-Feature: Communities of Practice https://www.hackforla.org/communities-of-practice ready for dev lead Issues that tech leads or merge team members need to follow up on role: back end/devOps Tasks for back-end developers role: front end Tasks for front end developers size: 0.25pt Can be done in 0.5 to 1.5 hours
Projects
4 participants