mirror of
https://github.com/semantica-agi/semantica.git
synced 2026-08-29 04:26:20 +00:00
KaifAhmad1andClaude Sonnet 4.6
d8b8ae634b
Closes CodeQL alerts #12, #13, #14, #15, #16, #17, #18 CRITICAL - fix(media_parser): replace eval() with fractions.Fraction for fps parsing (CWE-95) - fix(agent_memory): replace pickle serialization with JSON to prevent RCE (CWE-502) HIGH - fix(snowflake_ingestor): parameterize LIMIT/OFFSET, validate ORDER BY with regex, reject semicolons in WHERE to prevent SQL injection (CWE-89) - fix(rdf_parser): add defusedxml XXE protection for RDF/XML format parsing (CWE-611) - fix(server): add CORSMiddleware, security response headers middleware (X-Content-Type-Options, X-Frame-Options, X-XSS-Protection, Referrer-Policy, Permissions-Policy, HSTS), and global error handler (CWE-346, CWE-200) - fix(explorer/app): narrow CORS to specific methods/headers, redact exception messages in HTTP error handlers, enforce 64 KB WebSocket message size cap (CWE-346) MEDIUM - fix(graph): replace free-text algorithm param with _PathAlgorithm enum (CWE-20) - fix(vocabulary): validate uploaded file extensions against allowlist (CWE-434) - fix(llm_extraction): json.dumps() all user content in LLM prompts to block prompt-injection attacks (CWE-1336) - fix(pipeline_validator): replace __import__("collections") with proper import (CWE-95) LOW - fix(sparql): cap results at 5 000 rows and enforce 30-second query timeout (CWE-400) - fix(export_import): validate file extension + enforce 50 MB upload limit (CWE-434) CodeQL / scanning - feat(codeql): add .github/codeql/codeql-config.yml to exclude generated cookbook HTML bundles (Plotly + MapLibre) from JS scanning - feat(codeql): extend dismiss-fixed-alerts job with all new rule IDs (py/path-injection, py/polynomial-redos, js/incomplete-url-substring-sanitization, js/insecure-randomness, js/prototype-pollution-utility) Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
12 lines
536 B
YAML
12 lines
536 B
YAML
name: "Semantica CodeQL Config"
|
|
|
|
# Exclude auto-generated notebook exports and bundled third-party JS.
|
|
# Files in cookbook/**/*.html are self-contained Plotly/MapLibre bundles
|
|
# produced by Jupyter nbconvert — they embed minified third-party libraries
|
|
# (Plotly, MapLibre GL JS) whose internal patterns trigger false-positive JS
|
|
# alerts (js/incomplete-url-substring-sanitization, js/insecure-randomness,
|
|
# js/prototype-pollution-utility). These are not application code.
|
|
paths-ignore:
|
|
- "cookbook/**/*.html"
|
|
- "cookbook/**/*.js"
|