chore: re-anchor go/log-injection CodeQL suppression after route-group split - #1321
Merged
Merged
Conversation
…p split The management-API authorization hardening changed RemoteServerHandler.RegisterRoutes to a (read, admin *gin.RouterGroup) split, adding lines above Update() and shifting the suppressed logger.Log()...Warn() sink in remote_server_handler.go from line 142 to ~148. The exact-line suppression entry no longer matched, so the findings-gate counted the (unchanged, still-false-positive) go/log-injection result as blocking on the full-tree scan run by the main->development propagation PR. Widen the entry to a line_range (146-150), mirroring the existing uptime_service.go sibling entry that hit the same drift, so the multi-line log chain stays covered regardless of which line CodeQL anchors to. No code or behavior change. Claude-Session: https://claude.ai/code/session_01Jz4LgwfkxaF8E7TdAgk94y
Contributor
|
You are seeing this message because GitHub Code Scanning has recently been set up for this repository, or this pull request contains the workflow file for the Code Scanning tool. What Enabling Code Scanning Means:
For more information about GitHub Code Scanning, check out the documentation. |
Codecov Report✅ All modified and coverable lines are covered by tests. 📢 Thoughts on this report? Let us know! |
Contributor
✅ Supply Chain Verification Results✅ PASSED 📦 SBOM Summary
🔍 Vulnerability Scan
📎 Artifacts
Generated by Supply Chain Verification workflow • View Details |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Why
The management-API authorization hardening (#1316) changed
RemoteServerHandler.RegisterRoutesto a(read, admin *gin.RouterGroup)split, adding lines aboveUpdate()and shifting the already-suppressedlogger.Log()...Warn()go/log-injectionsink inremote_server_handler.gofrom line 142 to ~148..github/codeql/codeql-suppressions.ymlpinned that entry to an exactline: 142, so after the shift the findings-gate no longer matched it and counted the (unchanged, still-false-positive — logging auintprimary key) result as blocking on the full-tree CodeQL scan that themain→developmentpropagation PR (#1320) runs. #1316's own CodeQL check passed because PR-scoped analysis is diff-informed and doesn't re-block a pre-existing finding whose suppression drifted.Change
Widen the entry to
line_range: {start: 146, end: 150}, exactly mirroring the siblinguptime_service.goentry that hit this same drift before (commit8466a6eb), so the multi-line log chain stays covered regardless of which line CodeQL anchorsstartLineto. Reason text keeps a datedExtended 2026-09-09note per the file's convention.No code or behavior change. Data-only edit to the CodeQL suppression list. Unblocks #1320.