mirror of
https://github.com/gesellix/Bose-SoundTouch.git
synced 2026-09-07 15:07:17 +00:00
Tobias GesellchenandClaude Sonnet 5
734b921ac1
es-module-shims.js (vendored verbatim from npm) tripped 3 CodeQL findings (js/incomplete-sanitization, js/bad-code-sanitization x2) -- real escaping-order bugs in the library's own source, verified by hand, but not reachable in how this project uses it (no dynamic import() built from untrusted input, no CSP nonce ever set). Reported upstream separately. The javascript-typescript CodeQL matrix entry had no path exclusions at all, unlike the existing Go config's paths-ignore for vendor/generated code, so preact.module.js and htm.module.js were exposed to the same risk even though neither had tripped a finding yet. Add a JS-specific config excluding pkg/service/soundtouchweb/static/lib/** -- we don't control or modify these files, so findings there aren't actionable from this repo. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
20 lines
704 B
YAML
20 lines
704 B
YAML
# CodeQL configuration
|
|
# https://docs.github.com/en/code-security/code-scanning/creating-an-advanced-setup-for-code-scanning/customizing-your-advanced-setup-for-code-scanning
|
|
|
|
name: "JavaScript/TypeScript Security Analysis"
|
|
|
|
disable-default-queries: false
|
|
|
|
queries:
|
|
- uses: security-extended
|
|
- uses: security-and-quality
|
|
|
|
# Paths to exclude from analysis
|
|
paths-ignore:
|
|
- "**/node_modules/**"
|
|
# Vendored third-party libraries (preact, htm, es-module-shims), copied
|
|
# verbatim from npm by scripts/update-static-deps.sh. We don't modify or
|
|
# control their internals, so findings here aren't actionable from this
|
|
# repo -- report upstream instead.
|
|
- "pkg/service/soundtouchweb/static/lib/**"
|