2GT-RichandClaude Opus 4.8
b3ba2b98dc
Address the open CodeQL code-scanning alerts:
- guestWifi voucher codes now use rejection sampling so the character
distribution is uniform (fixes js/biased-cryptographic-random).
- Scheduled-report recipient validation replaced the backtracking email regex
with a linear split-based check (fixes js/polynomial-redos).
- Add .github/codeql/codeql-config.yml excluding js/missing-rate-limiting:
rate limiting is applied globally via app.use('/api', rateLimitRedis) plus
per-route limiters, which CodeQL can't attribute to individual handlers, so
that rule fired ~38 false positives.
Remaining alerts are dismissed as accepted/false-positive (RouterOS MD5 API
login and self-signed cert acceptance are protocol-mandated; log sites already
strip CRLF).
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
11 lines
532 B
YAML
11 lines
532 B
YAML
name: "MikroTik Manager CodeQL config"
|
|
|
|
# Rate limiting is enforced globally in Express — `app.use('/api', rateLimitRedis(...))`
|
|
# in backend/src/index.ts, plus dedicated limiters on auth/login/TOTP/OIDC routes.
|
|
# CodeQL's data flow can't attribute a global app-level middleware to each individual
|
|
# route handler, so `js/missing-rate-limiting` fires on ~every DB/fs handler as a false
|
|
# positive. Exclude it rather than carry dozens of non-actionable "high" alerts.
|
|
query-filters:
|
|
- exclude:
|
|
id: js/missing-rate-limiting
|