B14.1 Bi-Annual Triage CodeQL Static Code Analysis Scan Results

[jordanpadams]

💡 Description

Repos to triage static code analysis:

• [X] pds4-information-model - 1 code scan vulnerability alert dismissed. 0 dependabot alerts.
• [X] pds4-jparser - 0 new alerts to triage. existing alerts are not critical to address. merged 1 upgrade to fix 2 dependabot alerts (very low criticality)
• [X] validate - pds4-jparser - 0 new code scan vulnerability alerts to triage. existing alerts are not critical to address. 0 dependabot alerts.
• [X] registry-common - 0 new code scan vulnerability alerts to triage. existing alerts have fixes in the queue. 0 dependabot alerts.
• [X] harvest - 0 code scan vulnerability alerts to triage. 0 dependabot alerts.
• [X] registry-mgr - 0 new code scan security alerts to triage. 0 dependabot alerts.
• [X] registry-loader - 0 code scan vulnerability alerts to triage. 0 dependabot alerts.
• [X] ~registry-harvest-service~ - deprecated
• [X] ~registry-crawler-service~ - deprecated
• [C] ~registry-harvest-cli~ - deprecated
• [X] registry-sweepers - 0 code scan vulnerability alerts. 0 dependabot alerts.
• [X] registry-api - 0 new code scan vulnerability alerts to triage. existing alerts will be addressed in current, B14.1 delivery. all dependabot alerts resolved.
• [X] registry - 0 code scan vulnerability alerts. 0 dependabot alerts.
• [X] pds-api - 0 code scan vulnerability alerts. 0 dependabot alerts.
• [X] pds-api-client - 0 code scan vulnerability alerts. 0 dependabot alerts.
• [X] doi-service - 1 new issue identified. https://github.com/NASA-PDS/doi-service/issues/428. Very low risk. 0 dependabot alerts.
• [x] deep-archive - 0 code scan vulnerability alerts. 0 dependabot alerts.
• [X] mi-label - 0 code scan vulnerability alerts. 0 dependabot alerts.
• [X] ~PLAID~ - deprecated
• [X] Transform - - 0 code scan vulnerability alerts. 0 dependabot alerts.
• [X] data-upload-manager - 0 code scan vulnerability alerts. 0 dependabot alerts.
• [X] nucleus - 0 code scan vulnerability alerts. 1 dependabot alerts dismissed.
• [X] registry-harvest-legacy - dismissed ~10 code scan vulnerability alerts (wontfix/false positive). 0 dependabot alerts.
• [X] registry-pds3-catalog - dismissed 60 code scan vulnerability alerts (wontfix - not relevant). 0 dependabot alerts.
• [X] registry-mgr-legacy - dismissed 1 code scan vulnerability alert (wontfix - not relevant). 0 dependabot alerts.
• [X] pds3-product-tools - 0 code scan vulnerability alerts. 0 dependabot alerts.
• [X] search-api-notebook - local code execution software. code scanning not relevant. 1 dependabot alert. Not relevant currently as app is run locally.
• [X] updart - 0 code scan vulnerability alerts. 0 dependabot alerts.

Javascript/JSP/web:

• [X] wds-react-legacy - 0 code scan vulnerability alerts. dependabot alerts are only applicable to prototype code.
• [X] doi-ui - 0 code scan vulnerability alerts. dependabot alerts will be fixed prior to deployment. app is currently only deployed locally.
• [X] wds-react - error executing codeql. this code is still prototype.
• [X] ds-view - 0 code scan vulnerability alerts. 0 dependabot alerts.
• [X] search-ui-legacy - error executing codeql. will need to investigate. 0 dependabot alerts. this code is app scanned prior to release to alleviate risk.
• [X] feedback-widget - 0 code scan vulnerability alerts. 0 dependabot alerts.

[jordanpadams]

📆 01/2024 status: Start delayed 1 sprint. No impact on delivery.

[nutjob4life]

Jordan will be going through all the "ignored" reports and triaging the high-priority items. You'll be seeing issues assigned soon!

[jordanpadams]

Review complete