Repository navigation
Suppress warnings from Github #9298
Description
Hi!
I am trying to suppress a warning from what I understand a false positive zip-slip validation. We are using the GitHub Code Scanning job for running CodeQL. Even when I add the // lgtm[go/zipslip] tag in the code I still get the warning.
Example case:
https://github.com/argoproj/argo-cd/pull/8789/checks?check_run_id=5574205353
Is // lgtm tags supported by Github Code Scanning jobs? If not, how could I suppress warnings in this case?
Thank you!
Activity
leoluz commentedon Mar 18, 2022
By the way, the false positive warning is pointing this line complaining about unsanitized
targetvariable. However the sanitization code is applied by theInboundfunction called a few lines above. It seems the zipslip validation isn't able to follow that function. Sorry but this is just a guess as I don't know how codeql query works. If I copy the code fromInboundinside the caller function the warning goes away.aibaars commentedon Mar 18, 2022
Alert suppression using
//lgtmor otherwise is not supported by GitHub Code Scanning.@smowton Could you have a look at this? At a glance the sanitization code looks fine. Should the query be updated to recognize the sanitization code ?
smowton commentedon Mar 18, 2022
It'll be difficult to accurately classify https://github.com/argoproj/argo-cd/blob/77f9515547096ea939dd8b0b3aeae77708f11795/util/io/files/util.go#L80 as a barrier guard. Manually dismissing the warning is probably right in this case. @aibaars can you advise how to do that?
aibaars commentedon Mar 18, 2022
Manually dismissing can be done in the UI.
leoluz commentedon Mar 21, 2022
Tks all for confirming this.
We dismissed from the UI but I was wondering if there is a declarative way of doing it like using the
// lgtm[]tag but that didn't work for me.smowton commentedon May 25, 2022
Closing as answered: no there isn't an inline comment mechanism for suppression in current code scanning, but manual dismissal via the UI can be done.
remove nosec before system time call because CodeQL doesn't support this
aibaars commentedon Sep 15, 2023
You may want to use https://github.com/advanced-security/dismiss-alerts to automate the task of dismissing alerts that have suppression markers in the code.
docs(tts): record the cs/web/xss evidence at the Piper wire (gh-#161)
docs(llm): record why the weak-hashing alert is dismissed, not fixed
docs(llm): record why the weak-hashing alert is dismissed, not fixed
chore(llm): use SHA-256 for the model cache key and record why alert …