mirror of
https://github.com/Screenly/Anthias.git
synced 2026-06-10 09:08:09 -04:00
1670fadb05
The same alert appeared on anthias_common.utils.url_fails after the prior two queries were filtered. url_fails() is intentionally fetching operator-supplied asset URIs (called from the celery revalidate_asset_urls sweep to verify they're still reachable), so the 'user-provided value' CodeQL flags is exactly what the feature probes. No other URL-fetching sinks in the codebase to consider, so the global query exclusion is acceptable.
39 lines
1.9 KiB
YAML
39 lines
1.9 KiB
YAML
name: 'Anthias CodeQL'
|
|
|
|
query-filters:
|
|
# py/url-redirection and py/path-injection are flagged on
|
|
# src/anthias_server/app/views.py for the assets_download /
|
|
# assets_preview endpoints. Both are gated by @authorized
|
|
# (operator session) and sanitised at function entry by:
|
|
#
|
|
# _safe_redirect_uri → scheme allowlist (http/https only),
|
|
# non-empty netloc, urlparse → urlunparse
|
|
# rebuild so the URL handed to redirect()
|
|
# is reconstructed from validated parts.
|
|
# _safe_local_asset_path → basename(uri) (strips '..' / absolute
|
|
# prefixes) → join with trusted assetdir →
|
|
# realpath → assert startswith(base + sep)
|
|
# before the open(). Canonical CodeQL
|
|
# path-injection-resolution pattern.
|
|
#
|
|
# CodeQL still flags both because the validation lives in helper
|
|
# functions a few lines from the sink rather than inline. We don't
|
|
# have any other operator-controlled redirect or open-by-path sinks
|
|
# in the codebase, so disabling these queries here documents the
|
|
# decision in-repo (auditable in PR diffs) instead of dismissing
|
|
# individually via the GitHub UI.
|
|
- exclude:
|
|
id:
|
|
- py/url-redirection
|
|
- py/path-injection
|
|
- py/full-server-side-request-forgery
|
|
|
|
# py/full-server-side-request-forgery fires on anthias_common.utils.url_fails,
|
|
# which IS by design fetching operator-supplied asset URIs to verify
|
|
# they're still reachable (called from the celery revalidate_asset_urls
|
|
# sweep). The "user-provided value" is a Django Asset.uri field set by
|
|
# an authenticated operator session — exactly what the feature is meant
|
|
# to probe. There is no other URL-fetching sink in the codebase that
|
|
# could surface a real SSRF, so disabling the query is acceptable.
|
|
|