Exclude vendored code from CodeQL, keep tests in scope - #355
Merged
Conversation
Re-enabling JavaScript analysis surfaced 14 alerts across the t3x fleet. Four of them are the same rule, js/bad-tag-filter, inside one vendored file: Resources/Public/JavaScript/Vendor/marked.esm.js in netresearch/t3x-nr-mcp-agent. That is a third-party parser we ship and do not maintain. It cannot be fixed in the consuming repository — the remedy is a version bump — and until then it crowds out the alerts that are actionable. The init step therefore ignores vendored trees: **/Vendor/**, **/vendor/**, **/node_modules/** and .Build/**. Test paths are deliberately NOT excluded, and that is the more important half of this change. The first real finding this analysis produced was a credential logged in clear text by a Playwright login helper (netresearch/t3x-contexts, fixed in 07812f2a) — test code writes to CI logs like any other code, and excluding it would have hidden exactly the kind of leak the scanner exists to catch. Signed-off-by: Sebastian Mendel <sebastian.mendel@netresearch.de>
|
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Stops CodeQL reporting on third-party code we ship but do not maintain.
Why
Re-enabling JavaScript analysis across the
t3x-*fleet (#348) surfaced 14 open alerts. Four of them are the same rule —js/bad-tag-filter— inside a single vendored file:That is a third-party markdown parser. The finding cannot be fixed in the consuming repository; the remedy is a version bump of the vendored library. Until then each alert is permanent noise that crowds out the ones somebody can act on.
What changes
The
initstep gains aconfigwithpaths-ignorefor vendored trees:Vendor/(capitalised) is the TYPO3 convention for shipped third-party assets;vendor/,node_modules/and.Build/cover the Composer, npm and build trees.What deliberately does not change
Test paths stay in scope, and that is the more important half of this change.
The first real finding this analysis produced was a credential logged in clear text by a Playwright login helper —
js/clear-text-logging, HIGH, innetresearch/t3x-contexts, fixed in07812f2a. Test code writes to CI logs like any other code, and aBuild/**orTests/**exclusion would have hidden exactly the class of leak the scanner exists to catch.Effect
Four of the fourteen alerts disappear on the next scan, without anyone dismissing a finding by hand. The remaining ten are in first-party code and are being triaged individually.