From 56b83ca020aa7a9b990cf4affc68745b68d58bb9 Mon Sep 17 00:00:00 2001 From: maziggy Date: Sun, 19 Apr 2026 09:59:09 +0200 Subject: [PATCH] chore(ci): silence false-positive Bandit B108 + CodeQL LDAP/URL findings --- .codeql/codeql-config.yml | 16 ++++++++++++++++ 1 file changed, 16 insertions(+) diff --git a/.codeql/codeql-config.yml b/.codeql/codeql-config.yml index ed66a4109..4242180e2 100644 --- a/.codeql/codeql-config.yml +++ b/.codeql/codeql-config.yml @@ -75,6 +75,22 @@ query-filters: - exclude: id: py/catch-base-exception + # LDAP injection: All user input is RFC 4515 escaped via + # _ldap_escape() (ldap_service.py:282) before interpolation + # into search filters. CodeQL does not trace through the + # escape replace-loop and reports false positives on lines + # 131 / 183 / 198 where escaped values are reused. + - exclude: + id: py/ldap-injection + + # Incomplete URL substring sanitization: Only triggers in + # test assertions (test_cloud_auth.py) that verify the + # mocked HTTP client saw the right hostname + # (e.g. `"api.bambulab.cn" in captured_url`). URLs come + # from a mock's captured_urls list, not user input. + - exclude: + id: py/incomplete-url-substring-sanitization + # ── JavaScript Accepted Risk ───────────────────────────────── # XSS through DOM: False positives —