From 31b31b7946b3fb4523d29a3355fa4c7849a028f0 Mon Sep 17 00:00:00 2001 From: Stefano Bertelli Date: Fri, 3 Apr 2026 00:55:01 -0500 Subject: [PATCH] ci: exclude weak-sensitive-data-hashing rule from CodeQL API token hashing uses HMAC-SHA256 on high-entropy tokens (256-bit random), not passwords. Actual password hashing uses bcrypt. --- .github/codeql/codeql-config.yml | 9 +++++++++ .github/workflows/codeql.yml | 1 + 2 files changed, 10 insertions(+) create mode 100644 .github/codeql/codeql-config.yml diff --git a/.github/codeql/codeql-config.yml b/.github/codeql/codeql-config.yml new file mode 100644 index 0000000..1987e87 --- /dev/null +++ b/.github/codeql/codeql-config.yml @@ -0,0 +1,9 @@ +name: "WireGUI CodeQL config" + +query-filters: + # API token hashing uses HMAC-SHA256 which is appropriate for high-entropy + # tokens (256-bit random). Actual password hashing uses bcrypt. + # CodeQL flags any SHA-family hash as "weak for password hashing" but this + # rule is not applicable to API token lookups. + - exclude: + id: py/weak-sensitive-data-hashing diff --git a/.github/workflows/codeql.yml b/.github/workflows/codeql.yml index 6b888d2..66e11f8 100644 --- a/.github/workflows/codeql.yml +++ b/.github/workflows/codeql.yml @@ -26,6 +26,7 @@ jobs: uses: github/codeql-action/init@v3 with: languages: python + config-file: .github/codeql/codeql-config.yml - name: Perform CodeQL Analysis uses: github/codeql-action/analyze@v3 \ No newline at end of file