ER: CodeQL did not raise alerts on each instance of "Potentially unsafe external link"

[roslynwythe]

Dependencies

The issue could be resolved with:

• Update codeql.yml to exclude YAML front-matter and Liquid code #6548

Emergent Requirement - Problem

• The file _includes/current_guides.html contained two instances of "Potentially unsafe external links" but only one CodeQL alert was raised.
• The file _includes/about-page/about-card-sponsors contained four instance of ""Potentially unsafe external links" but only one CodeQL alert was raised

Details

Regarding _includes/current_guides.html:

• The first instance is on line 77 as detailed in https://github.com/hackforla/website/security/code-scanning/3
• The second instance is on line 80. No CodeQL alert was found addressing this instance and so Resolve "Potentially unsafe external link" in _includes/current-guides.html #6484 was created

Issue you discovered this emergent requirement in

• Resolve CodeQL alert 3 "Potentially unsafe external link" #6044

Date discovered

3/4/2024

Did you have to do something temporarily

• YES Resolve "Potentially unsafe external link" in _includes/current-guides.html #6484 was created
• NO

Who was involved

@djbradleyii

What happens if this is not addressed

code security/quality issues may be missed

Resources

Recommended Action Items

• Make a new issue
• Discuss with team
• Let a Team Lead know

Potential solutions [draft]

• We are aware that CodeQL runs into errors scanning Javascript code files with liquid statements. In both files in which CodeQL failed to report errors, liquid code was found. Therefore I suggest putting this ER on hold, with a dependency on update project profile food oasis reorder leadership member #6387
• Search/audit the codebase for any other instances of "Potentially unsafe external link" that are not detected by CodeQL
• resarch to determine possible reasons why CodeQL did not create an alert for this instance of "Potentially unsafe external link"

[github-actions]

Hi @roslynwythe.

Please don't forget to add the proper labels to this issue. Currently, the labels for the following are missing:

• Complexity, Role, Feature

NOTE: Please ignore this comment if you do not have 'write' access to this directory.

To add a label, take a look at Github's documentation here.

Also, don't forget to remove the "missing labels" afterwards.
To remove a label, the process is similar to adding a label, but you select a currently added label to remove it.

After the proper labels are added, the merge team will review the issue and add a "Ready for Prioritization" label once it is ready for prioritization.

Additional Resources:

• Wiki: How to create issues
• Wiki: How to read and interpret labels