Resolve remaining high/medium CodeQL alerts - #5629
Merged
norman-abramovitz merged 8 commits intoJul 11, 2026
Merged
Conversation
Invalid-provider errors formatted the whole DatabaseConfig (including the database password) into a message that reaches log.Fatal, and the console setup dumped ConsoleConfig (including the client secret) at debug level. Log only the provider name and UAA endpoint instead. CodeQL: go/clear-text-logging (alerts 30, 31).
The terminal's exec websocket dialed the Kubernetes API server with InsecureSkipVerify unconditionally. Read the in-cluster CA bundle from the service-account mount (alongside the token we already read) and verify against it; fall back to skipping verification only in the env-var-token dev setup where no CA file is mounted. CodeQL: go/disabled-certificate-check (alert 33).
Backup payload encryption keyed AES-256 with a single unsalted SHA256 of the user's password, allowing fast offline brute force of a leaked backup file. Derive the key with PBKDF2-HMAC-SHA256 (600k iterations, random 16-byte salt stored after a magic prefix). Files without the prefix decrypt via the legacy path so existing backups still restore; a round-trip test covers both formats. CodeQL: go/weak-sensitive-data-hashing (alert 34).
The JSESSIONID cookie inherited session options without an explicit Secure flag. CF hosting always terminates TLS (the plugin already rejects non-https X-Forwarded-Proto), so mark the cookie Secure. CodeQL: go/cookie-secure-not-set (alert 21).
Missing-entity warnings interpolated catalog-supplied endpoint/entity types into the first console argument, which the console treats as a format string. Move the dynamic detail to a separate argument. CodeQL: js/tainted-format-string (alerts 13, 14).
pathSet had no callers left (pathGet remains in use) and its recursive path assignment was flagged for prototype pollution. Delete it and its spec instead of guarding dead code. CodeQL: js/prototype-pollution-utility (alert 15).
doMergeObjects copies keys from parsed YAML/JSON into the target; JSON.parse can produce an own __proto__ key, and assigning it walks into Object.prototype. Skip __proto__/constructor/prototype keys. CodeQL: js/prototype-pollution-utility (alert 16).
setPath assigned dot-separated path segments without filtering __proto__/constructor/prototype; reject paths containing them. CodeQL: js/prototype-pollution-utility (alert 17).
![github-advanced-security[bot]](https://avatars.githubusercontent.com/in/57789?s=60&v=4){kind=small}
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
3 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Follow-up to #5624: clears the remaining 14 high / 6 medium CodeQL alerts on develop. 10 are fixed here; the other 10 were dismissed with per-alert justifications (test infrastructure, pass-through response writer, closed-union inputs, by-design per-endpoint TLS opt-in).
Backend:
Frontend / tools:
Full make check gate is green; the backup change carries a new unit test for both the new and legacy formats.