ghas-codeql-remediation

CodeQL SAST Remediation

Overview

Fix GitHub CodeQL alerts by applying rule-specific and CWE-specific code transforms. Each fix pattern targets the root cause identified by CodeQL's dataflow analysis.

Fix Patterns by CWE Category

CWE-89: SQL Injection

• Detection: CodeQL rules java/sql-injection, js/sql-injection, python/sql-injection, csharp/sql-injection
• Fix: Replace string concatenation with parameterized queries or ORM methods
• Python: Use cursor.execute(query, params) instead of f-strings
• Java: Use PreparedStatement instead of Statement
• JavaScript: Use parameterized queries with ? placeholders
• C#: Use SqlCommand with SqlParameter

CWE-79: Cross-Site Scripting (XSS)

• Detection: js/xss, java/xss, python/xss
• Fix: Apply context-appropriate output encoding
• HTML context: HTML-entity encode (<, >, &, ")
• JavaScript context: JSON.stringify or JS escape
• URL context: URL-encode user input
• Use framework-provided auto-escaping (React JSX, Jinja2 autoescape, Razor)

CWE-78: Command Injection

• Detection: js/command-line-injection, python/command-line-injection
• Fix: Use array-based subprocess calls, never shell=True with user input
• Python: subprocess.run(["cmd", arg]) instead of os.system(f"cmd {arg}")
• Node.js: execFile("cmd", [arg]) instead of exec("cmd " + arg)

CWE-502: Insecure Deserialization

• Fix: Use allowlists for deserialized types, prefer JSON over binary serialization
• Java: Avoid ObjectInputStream on untrusted data, use JSON with Jackson/Gson
• Python: Never use pickle.loads() on untrusted data, use json.loads()
• C#: Use System.Text.Json with JsonSerializerOptions type restrictions

CWE-22: Path Traversal

• Fix: Canonicalize paths, validate against allowlist, strip .. sequences
• All languages: Resolve to absolute path, verify it starts with the expected base directory
• Never use user input directly in file paths without validation

CWE-327/328: Weak Cryptography

• Fix: Replace MD5/SHA1 with SHA-256+, use bcrypt/scrypt/argon2 for passwords
• Never use ECB mode, always use authenticated encryption (AES-GCM)
• Use framework-provided crypto utilities, not hand-rolled implementations

CWE-862: Missing Authorization

• Fix: Add authentication/authorization checks before protected operations
• Verify role-based access controls are applied at the handler/controller level
• Never rely solely on client-side authorization checks

Process

1. Fetch CodeQL alert details: rule ID, CWE, affected file:line, dataflow path
2. Identify the fix pattern from the CWE category above
3. Apply the fix in the affected file
4. Write a regression test using write-security-tests skill
5. Verify the fix resolves the alert (re-run CodeQL or verify dataflow is broken)