Fix CodeQL security alerts #122 and #123 - #2705
Merged
Merged
Conversation
nicholasdalhaug
approved these changes
May 11, 2026
Christdej
force-pushed
the
fix/security-alerts-122-123
branch
from
May 11, 2026 10:00
7a4d4e6 to
47d964d
Compare
Add an explicit top-level permissions block (contents: read) to the validate_dotnet_migrations_against_temp_db workflow so the GITHUB_TOKEN no longer relies on repository defaults. Addresses CodeQL alert actions/missing-workflow-permissions. Closes equinor#122 (code-scanning alert)
Replace logging of the user-influenced Position object with explicit numeric X/Y/Z coordinates and a sanitized task id. This addresses CodeQL alert cs/log-forging (CWE-117) where untrusted input from the custom mission endpoint could flow into log entries and forge new lines. Also make Sanitize.SanitizeUserInput null-safe by accepting a nullable string and returning string.Empty for null input rather than throwing NullReferenceException, removing a sharp edge for current and future callers. Closes equinor#123 (code-scanning alert)
Christdej
force-pushed
the
fix/security-alerts-122-123
branch
from
May 11, 2026 11:18
47d964d to
e45e704
Compare
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
AreaPolygonServiceby logging numeric coordinates and stripping CR/LF frommissionTask.Idvia the existingSanitizehelper (alert #123).permissions: contents: readblock tovalidate_dotnet_migrations_against_temp_db.yml(alert #122).Details
backend/api/Services/AreaPolygonService.cs: replaceLogWarningof the user-influencedPositionobject with explicitX/Y/Zdoubles (which are not log-forging sinks) and a sanitizedmissionTask.Id. Addsusing Api.Utilities;..github/workflows/validate_dotnet_migrations_against_temp_db.yml: declare workflow-levelpermissionsso theGITHUB_TOKENno longer relies on the repository default.Verification
dotnet buildfrombackend/apisucceeds with 0 warnings / 0 errors.Closes the following code-scanning alerts: