Scan with CodeQL

[jasongrout]

This will help track down issues like unused imports, etc. See https://docs.github.com/en/free-pro-team@latest/github/finding-security-vulnerabilities-and-errors-in-your-code/enabling-code-scanning-for-a-repository

Results at https://github.com/jupyter/jupyter_server/security/code-scanning?query=tool%3ACodeQL+is%3Aopen+ref%3Arefs%2Fpull%2F332%2Fmerge

[jasongrout]

Codeql reports 147 issues. Lots of low-hanging fruit there to tackle.

[jasongrout]

(I think we could merge this to expose the report, then resolving the reported issues can be low-hanging maintenance tasks)

[echarles]

Thx @jasongrout I guess a next step will be to open an issue with the report.

[jasongrout]

Thx @jasongrout I guess a next step will be to open an issue with the report.

The alerts are now available from the Security tab: https://github.com/jupyter/jupyter_server/security/code-scanning

I think from here it is just opening PRs fixing them.

[kevin-bates]

I would like that all pushed branches trigger this report so that would-be pull requests could first have a chance to address any flagged issues. I'll provide a PR to make that change.

Overall, this seems a little invasive in my opinion. For example, the tests re-use r to hold responses all over the place.

If a given flagged issue is dismissed, do you know if it records that dismissal so as to not raise it again? I guess I need to go look at CodeQL.

[jasongrout]

If a given flagged issue is dismissed, do you know if it records that dismissal so as to not raise it again? I guess I need to go look at CodeQL.

I think so? At least, that would make sense to me.

[kevin-bates]

Yeah, after looking at the results on my pushed branch (for #333), no new alerts were found so the security tab represents an accumulation of whatever has been encountered, which, I agree, must consist of some persisted state.

Once we get the flagged issues addressed, things will settle down (in my head 😄 ).

[farisachugthai]

Hey I'm sorry @jasongrout but I might be missing something here. The results link provided doesn't seem to be working and the security/code-scanning isn't working either.

I tried looking under actions to see the code scan being run in this repos workflow but couldn't locate that either.

Id definitely be interested in helping to fix these issues but unless I'm missing something I can't see the results 😞