We now use Code QL to perform a static analysis of our code to alert us of security anti-patterns. The ones we have so far are mostly of the same types. Not all of them may be actual problems, but worth looking into.
🏁 DoD
[ ] Python (high): Uncontrolled data used in path expression
[ ] Python (high): Clear-text storage of sensitive information
[ ] Javascript (medium): DOM text reinterpreted as HTML
[ ] Code QL is made a required step, if applicable
📋 Info
We now use Code QL to perform a static analysis of our code to alert us of security anti-patterns. The ones we have so far are mostly of the same types. Not all of them may be actual problems, but worth looking into.
🏁 DoD