Commiteded0ed

authored

chore: fix false positives in CodeQL (#17138)

Clears up some false positives being surfaced by CodeQL

1 parente1f27a7 commiteded0edCopy full SHA for eded0ed

File tree

-10

lines changed

-10

lines changed

Lines changed: 4 additions & 10 deletions

Original file line number	Diff line number	Diff line change
`@@ -491,21 +491,15 @@ func convertDockerInspect(raw []byte) ([]codersdk.WorkspaceAgentContainer, []str`
`491`	`491`	`//"8080" -> 8080, "tcp"`
`492`	`492`	`funcconvertDockerPort(instring) (uint16,string,error) {`
`493`	`493`	`parts:=strings.Split(in,"/")`
	`494`	`+p,err:=strconv.ParseUint(parts[0],10,16)`
	`495`	`+iferr!=nil {`
	`496`	`+return0,"",xerrors.Errorf("invalid port format: %s",in)`
	`497`	`+}`
`494`	`498`	`switchlen(parts) {`
`495`	`499`	`case1:`
`496`	`500`	`// assume it's a TCP port`
`497`		`-p,err:=strconv.Atoi(parts[0])`
`498`		`-iferr!=nil {`
`499`		`-return0,"",xerrors.Errorf("invalid port format: %s",in)`
`500`		`-}`
`501`		`-// #nosec G115 - Safe conversion since Docker TCP ports are limited to uint16 range`
`502`	`501`	`returnuint16(p),"tcp",nil`
`503`	`502`	`case2:`
`504`		`-p,err:=strconv.Atoi(parts[0])`
`505`		`-iferr!=nil {`
`506`		`-return0,"",xerrors.Errorf("invalid port format: %s",in)`
`507`		`-}`
`508`		`-// #nosec G115 - Safe conversion since Docker ports are limited to uint16 range`
`509`	`503`	`returnuint16(p),parts[1],nil`
`510`	`504`	`default:`
`511`	`505`	`return0,"",xerrors.Errorf("invalid port format: %s",in)`

Lines changed: 1 addition & 0 deletions

Original file line number	Diff line number	Diff line change
`@@ -76,6 +76,7 @@ func listFiles(query LSRequest) (LSResponse, error) {`
`76`	`76`	`returnLSResponse{},xerrors.Errorf("failed to get absolute path of %q: %w",fullPathRelative,err)`
`77`	`77`	`}`
`78`	`78`
	`79`	`+// codeql[go/path-injection] - The intent is to allow the user to navigate to any directory in their workspace.`
`79`	`80`	`f,err:=os.Open(absolutePathString)`
`80`	`81`	`iferr!=nil {`
`81`	`82`	`returnLSResponse{},xerrors.Errorf("failed to open directory %q: %w",absolutePathString,err)`

Lines changed: 1 addition & 0 deletions

Original file line number	Diff line number	Diff line change
`@@ -1100,6 +1100,7 @@ func (api API) userOAuth2Github(rw http.ResponseWriter, r http.Request) {`
`1100`	`1100`	`// We use AuthCodeURL from the OAuth2Config field instead of the one on`
`1101`	`1101`	`// GithubOAuth2Config because when device flow is configured, AuthCodeURL`
`1102`	`1102`	`// is overridden and returns a value that doesn't pass the URL check.`
	`1103`	`+// codeql[go/constant-oauth2-state] -- We are solely using the AuthCodeURL from the OAuth2Config field in order to validate the hostname of the external auth provider.`
`1103`	`1104`	`ifexternalauth.IsGithubDotComURL(api.GithubOAuth2Config.OAuth2Config.AuthCodeURL(""))&&user.GithubComUserID.Int64!=ghUser.GetID() {`
`1104`	`1105`	`err=api.Database.UpdateUserGithubComUserID(ctx, database.UpdateUserGithubComUserIDParams{`
`1105`	`1106`	`ID:user.ID,`

Comments

(0)