bleedingdeacons / fellowship / 33974210915
90%

DEFAULT BRANCH: main
Ran
Jobs 1
Files 57
Run time 1min
Badge
Embed ▾
README BADGES
x

If you need to use a raster PNG badge, change the '.svg' to '.png' in the link

Markdown

Textile

RDoc

HTML

Rst
coverage: 92.137%. Remained the same
33974210915

push

github

web-flow 
fix: annotate the six Semgrep findings, all of which are false positives

None of the six is a defect. Each is annotated where it fires, with the
reason, rather than left to be re-triaged by whoever next opens the
dashboard.

Five are php.symfony.security.audit.symfony-non-literal-redirect, which
matches ->redirect() with a non-literal argument. This is not Symfony's
redirect: it is a private helper that builds

    wp_safe_redirect(add_query_arg(
        ['page' => ..., 'fellowship_result' => $result],
        admin_url('admin.php'),
    ));

The base URL is fixed, the argument only ever becomes a query-parameter
value, and wp_safe_redirect refuses an off-site host regardless. The rule
matched on the method name alone.

The sixth is php.lang.security.taint-unsafe-echo-tag, traced from
$_GET['paged'] to the pagination markup. That value is cast to int before
it goes anywhere -- max(1, (int) filter_var(..., FILTER_VALIDATE_INT)) --
and passed to pagination(int $page, ...) under strict_types, so it cannot
carry a payload; the generated markup is run through wp_kses_post on top.
Semgrep follows the superglobal to the echo without treating either the
cast or wp_kses_post as a sanitiser.

nosemgrep sits on the line immediately above each finding, which is what
Semgrep requires -- the justification goes above that, not between. An
earlier version of this change put the directive at the top of the
comment block, seven lines from the code, where it would have suppressed
nothing while looking exactly as though it had.

This introduces nosemgrep to the suite, which had none. The alternative
was triaging in the dashboard, which leaves no trace in the repository:
the next person to read this code would have found a security finding
against it and no record of why it was dismissed.

PHPCS, PHPStan level 8 and all 560 tests still pass.

3199 of 3472 relevant lines covered (92.14%)

6.06 hits per line

Coverage Regressions

Lines Coverage ∆ File
9
94.69
0.0% fellowship/fellowship/src/Admin/DevicesPage.php
7
95.07
0.0% fellowship/fellowship/src/Admin/SettingsPage.php
6
90.1
0.0% fellowship/fellowship/src/Admin/ComposePage.php
Jobs
ID Job ID Ran Files Coverage
1 33974210915.1 57
92.14
GitHub Action Run
Source Files on build 33974210915