Add CodeQL as Code Analysis Tool

flo-schu / diverssite

0 stars 1 forks source link

Add CodeQL as Code Analysis Tool #61

Closed hf-kklein closed 1 year ago

hf-kklein commented 2 years ago

CodeQL checks the code for vulnerabilities. For Details see https://codeql.github.com/

flo-schu commented 1 year ago

The severe vulnerabilities all come from static code (copied bootstrap library). This can be resolved by using an up-to-date version included in the link section of the page head

smaller vulnerabilities are inside the code and should be easily fixed

flo-schu commented 1 year ago

vulnerabilities from unused code were removed

input of passphrase for registration is processed as raw-text (change to password field) This will be tackled in #71

other critical vulnerabilities come from probably old versions of admin and markdownx packages. An issue has been created to address this in the future #80

markdownx is still at the same version (would have to be forked)
admin vulnerabilites can possibly be resolved by upgrading django