From 734b921ac16a70af3ea6d2dca6e609415fa7c4d2 Mon Sep 17 00:00:00 2001
From: Tobias Gesellchen <tobias@gesellix.de>
Date: Sat, 29 Aug 2026 16:59:30 +0200
Subject: [PATCH] ci: exclude vendored static JS libs from CodeQL analysis

es-module-shims.js (vendored verbatim from npm) tripped 3 CodeQL
findings (js/incomplete-sanitization, js/bad-code-sanitization x2) --
real escaping-order bugs in the library's own source, verified by hand,
but not reachable in how this project uses it (no dynamic import()
built from untrusted input, no CSP nonce ever set). Reported upstream
separately.

The javascript-typescript CodeQL matrix entry had no path exclusions at
all, unlike the existing Go config's paths-ignore for vendor/generated
code, so preact.module.js and htm.module.js were exposed to the same
risk even though neither had tripped a finding yet. Add a JS-specific
config excluding pkg/service/soundtouchweb/static/lib/** -- we don't
control or modify these files, so findings there aren't actionable
from this repo.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
---
 .github/codeql-config-js.yml | 19 +++++++++++++++++++
 .github/workflows/codeql.yml |  2 +-
 2 files changed, 20 insertions(+), 1 deletion(-)
 create mode 100644 .github/codeql-config-js.yml

diff --git a/.github/codeql-config-js.yml b/.github/codeql-config-js.yml
new file mode 100644
index 00000000..47d5a0f8
--- /dev/null
+++ b/.github/codeql-config-js.yml
@@ -0,0 +1,19 @@
+# CodeQL configuration
+# https://docs.github.com/en/code-security/code-scanning/creating-an-advanced-setup-for-code-scanning/customizing-your-advanced-setup-for-code-scanning
+
+name: "JavaScript/TypeScript Security Analysis"
+
+disable-default-queries: false
+
+queries:
+  - uses: security-extended
+  - uses: security-and-quality
+
+# Paths to exclude from analysis
+paths-ignore:
+  - "**/node_modules/**"
+  # Vendored third-party libraries (preact, htm, es-module-shims), copied
+  # verbatim from npm by scripts/update-static-deps.sh. We don't modify or
+  # control their internals, so findings here aren't actionable from this
+  # repo -- report upstream instead.
+  - "pkg/service/soundtouchweb/static/lib/**"
diff --git a/.github/workflows/codeql.yml b/.github/workflows/codeql.yml
index 028c3af0..c8db5875 100644
--- a/.github/workflows/codeql.yml
+++ b/.github/workflows/codeql.yml
@@ -44,7 +44,7 @@ jobs:
         with:
           languages: ${{ matrix.language }}
           build-mode: ${{ matrix.build-mode }}
-          config-file: ${{ matrix.language == 'go' && './.github/codeql-config.yml' || '' }}
+          config-file: ${{ matrix.language == 'go' && './.github/codeql-config.yml' || matrix.language == 'javascript-typescript' && './.github/codeql-config-js.yml' || '' }}
 
       - name: Build Go (required for manual build-mode)
         if: matrix.language == 'go'