From eded0ed4b6a01e88b4b365d7b1e106bae1dd7623 Mon Sep 17 00:00:00 2001 From: Jon Ayers Date: Thu, 27 Mar 2025 16:06:58 -0500 Subject: [PATCH] chore: fix false positives in CodeQL (#17138) Clears up some false positives being surfaced by CodeQL --- agent/agentcontainers/containers_dockercli.go | 14 ++++---------- agent/ls.go | 1 + coderd/userauth.go | 1 + 3 files changed, 6 insertions(+), 10 deletions(-) diff --git a/agent/agentcontainers/containers_dockercli.go b/agent/agentcontainers/containers_dockercli.go index da42c813c5..b29f1e974b 100644 --- a/agent/agentcontainers/containers_dockercli.go +++ b/agent/agentcontainers/containers_dockercli.go @@ -491,21 +491,15 @@ func convertDockerInspect(raw []byte) ([]codersdk.WorkspaceAgentContainer, []str // "8080" -> 8080, "tcp" func convertDockerPort(in string) (uint16, string, error) { parts := strings.Split(in, "/") + p, err := strconv.ParseUint(parts[0], 10, 16) + if err != nil { + return 0, "", xerrors.Errorf("invalid port format: %s", in) + } switch len(parts) { case 1: // assume it's a TCP port - p, err := strconv.Atoi(parts[0]) - if err != nil { - return 0, "", xerrors.Errorf("invalid port format: %s", in) - } - // #nosec G115 - Safe conversion since Docker TCP ports are limited to uint16 range return uint16(p), "tcp", nil case 2: - p, err := strconv.Atoi(parts[0]) - if err != nil { - return 0, "", xerrors.Errorf("invalid port format: %s", in) - } - // #nosec G115 - Safe conversion since Docker ports are limited to uint16 range return uint16(p), parts[1], nil default: return 0, "", xerrors.Errorf("invalid port format: %s", in) diff --git a/agent/ls.go b/agent/ls.go index 1d8adea12e..9e65e26fdd 100644 --- a/agent/ls.go +++ b/agent/ls.go @@ -76,6 +76,7 @@ func listFiles(query LSRequest) (LSResponse, error) { return LSResponse{}, xerrors.Errorf("failed to get absolute path of %q: %w", fullPathRelative, err) } + // codeql[go/path-injection] - The intent is to allow the user to navigate to any directory in their workspace. f, err := os.Open(absolutePathString) if err != nil { return LSResponse{}, xerrors.Errorf("failed to open directory %q: %w", absolutePathString, err) diff --git a/coderd/userauth.go b/coderd/userauth.go index f08e126208..abbe2b4a9f 100644 --- a/coderd/userauth.go +++ b/coderd/userauth.go @@ -1100,6 +1100,7 @@ func (api *API) userOAuth2Github(rw http.ResponseWriter, r *http.Request) { // We use AuthCodeURL from the OAuth2Config field instead of the one on // GithubOAuth2Config because when device flow is configured, AuthCodeURL // is overridden and returns a value that doesn't pass the URL check. + // codeql[go/constant-oauth2-state] -- We are solely using the AuthCodeURL from the OAuth2Config field in order to validate the hostname of the external auth provider. if externalauth.IsGithubDotComURL(api.GithubOAuth2Config.OAuth2Config.AuthCodeURL("")) && user.GithubComUserID.Int64 != ghUser.GetID() { err = api.Database.UpdateUserGithubComUserID(ctx, database.UpdateUserGithubComUserIDParams{ ID: user.ID,