mirror of
https://github.com/gesellix/Bose-SoundTouch.git
synced 2026-09-07 15:07:17 +00:00
Tobias GesellchenandClaude Sonnet 5
734b921ac1
es-module-shims.js (vendored verbatim from npm) tripped 3 CodeQL findings (js/incomplete-sanitization, js/bad-code-sanitization x2) -- real escaping-order bugs in the library's own source, verified by hand, but not reachable in how this project uses it (no dynamic import() built from untrusted input, no CSP nonce ever set). Reported upstream separately. The javascript-typescript CodeQL matrix entry had no path exclusions at all, unlike the existing Go config's paths-ignore for vendor/generated code, so preact.module.js and htm.module.js were exposed to the same risk even though neither had tripped a finding yet. Add a JS-specific config excluding pkg/service/soundtouchweb/static/lib/** -- we don't control or modify these files, so findings there aren't actionable from this repo. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
57 lines
1.6 KiB
YAML
57 lines
1.6 KiB
YAML
name: "CodeQL Advanced"
|
|
|
|
on:
|
|
push:
|
|
branches: [ "main" ]
|
|
pull_request:
|
|
branches: [ "main" ]
|
|
schedule:
|
|
- cron: '36 6 * * 1'
|
|
|
|
jobs:
|
|
analyze:
|
|
name: Analyze (${{ matrix.language }})
|
|
runs-on: ubuntu-latest
|
|
permissions:
|
|
security-events: write
|
|
packages: read
|
|
actions: read
|
|
contents: read
|
|
|
|
strategy:
|
|
fail-fast: false
|
|
matrix:
|
|
include:
|
|
- language: actions
|
|
build-mode: none
|
|
- language: go
|
|
build-mode: manual
|
|
- language: javascript-typescript
|
|
build-mode: none
|
|
- language: python
|
|
build-mode: none
|
|
|
|
steps:
|
|
- name: Checkout repository
|
|
uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
|
|
|
|
- name: Install libpcap (required for Go build)
|
|
if: matrix.language == 'go'
|
|
run: sudo apt-get install -y libpcap-dev
|
|
|
|
- name: Initialize CodeQL
|
|
uses: github/codeql-action/init@db488ddef3bf6cb639b32c2e9a7c0a7ea8271d28 # v4.37.8
|
|
with:
|
|
languages: ${{ matrix.language }}
|
|
build-mode: ${{ matrix.build-mode }}
|
|
config-file: ${{ matrix.language == 'go' && './.github/codeql-config.yml' || matrix.language == 'javascript-typescript' && './.github/codeql-config-js.yml' || '' }}
|
|
|
|
- name: Build Go (required for manual build-mode)
|
|
if: matrix.language == 'go'
|
|
run: go build ./...
|
|
|
|
- name: Perform CodeQL Analysis
|
|
uses: github/codeql-action/analyze@db488ddef3bf6cb639b32c2e9a7c0a7ea8271d28 # v4.37.8
|
|
with:
|
|
category: "/language:${{ matrix.language }}"
|