From f2c644c3d7ee50efe6faf05c0be198ab9253a1f9 Mon Sep 17 00:00:00 2001 From: ABHAY PANDEY Date: Tue, 8 Sep 2026 23:55:27 +0530 Subject: [PATCH 1/2] ci: disable CodeQL Remove the CodeQL workflow, config, custom models, changeset, and route suppression comments to stop false-positive security findings on admin routes. --- .changeset/codeql-admin-rate-limit-models.md | 5 - .github/codeql/codeql-config.yml | 8 -- .../NostreamRateLimitingMiddleware.qll | 50 -------- .../codeql-pack.yml | 5 - .github/workflows/codeql.yml | 111 ------------------ src/routes/admin/index.ts | 6 +- src/routes/index.ts | 3 - 7 files changed, 2 insertions(+), 186 deletions(-) delete mode 100644 .changeset/codeql-admin-rate-limit-models.md delete mode 100644 .github/codeql/codeql-config.yml delete mode 100644 .github/codeql/extensions/nostream-javascript-models/NostreamRateLimitingMiddleware.qll delete mode 100644 .github/codeql/extensions/nostream-javascript-models/codeql-pack.yml delete mode 100644 .github/workflows/codeql.yml diff --git a/.changeset/codeql-admin-rate-limit-models.md b/.changeset/codeql-admin-rate-limit-models.md deleted file mode 100644 index a8ac269a..00000000 --- a/.changeset/codeql-admin-rate-limit-models.md +++ /dev/null @@ -1,5 +0,0 @@ ---- -"nostream": patch ---- - -fix: teach CodeQL to recognize custom admin rate limit middleware diff --git a/.github/codeql/codeql-config.yml b/.github/codeql/codeql-config.yml deleted file mode 100644 index c34da3e4..00000000 --- a/.github/codeql/codeql-config.yml +++ /dev/null @@ -1,8 +0,0 @@ -name: nostream-codeql - -packs: - javascript-typescript: - - cameri/nostream-javascript-models - -queries: - - uses: security-and-quality diff --git a/.github/codeql/extensions/nostream-javascript-models/NostreamRateLimitingMiddleware.qll b/.github/codeql/extensions/nostream-javascript-models/NostreamRateLimitingMiddleware.qll deleted file mode 100644 index 7dc94f95..00000000 --- a/.github/codeql/extensions/nostream-javascript-models/NostreamRateLimitingMiddleware.qll +++ /dev/null @@ -1,50 +0,0 @@ -/** - * Models Nostream's custom Redis-backed rate limit middleware for CodeQL's - * js/missing-rate-limiting query. - * - * CodeQL only recognizes popular npm rate limiters by default. Nostream uses - * in-repo middleware that calls isAdminRateLimited() / isRateLimited(). - */ - -import javascript -import semmle.javascript.security.dataflow.MissingRateLimiting - -private predicate isNostreamRateLimitCheck(CallExpr call, string calleeName) { - call.getCalleeName() = calleeName -} - -private predicate isInFile(Function fn, string fileSuffix) { - fn.getFile().getRelativePath().regexpMatch(".*/" + fileSuffix + "$") -} - -/** - * An admin route middleware function that invokes isAdminRateLimited(). - */ -class NostreamAdminRateLimiterFunction extends DataFlow::FunctionNode { - NostreamAdminRateLimiterFunction() { - exists(CallExpr call | - isNostreamRateLimitCheck(call, "isAdminRateLimited") and - call.getEnclosingFunction() = this.getFunction() and - isInFile(this.getFunction(), "admin-rate-limit-middleware.ts") - ) - } -} - -/** - * A connection-level middleware function that invokes isRateLimited(). - */ -class NostreamConnectionRateLimiterFunction extends DataFlow::FunctionNode { - NostreamConnectionRateLimiterFunction() { - exists(CallExpr call | - isNostreamRateLimitCheck(call, "isRateLimited") and - call.getEnclosingFunction() = this.getFunction() and - isInFile(this.getFunction(), "rate-limiter-middleware.ts") - ) - } -} - -class NostreamAdminRateLimitMiddleware extends RateLimitingMiddleware instanceof NostreamAdminRateLimiterFunction { -} - -class NostreamConnectionRateLimitMiddleware extends RateLimitingMiddleware instanceof NostreamConnectionRateLimiterFunction { -} diff --git a/.github/codeql/extensions/nostream-javascript-models/codeql-pack.yml b/.github/codeql/extensions/nostream-javascript-models/codeql-pack.yml deleted file mode 100644 index f0666693..00000000 --- a/.github/codeql/extensions/nostream-javascript-models/codeql-pack.yml +++ /dev/null @@ -1,5 +0,0 @@ -name: cameri/nostream-javascript-models -version: 0.0.1 -library: true -dependencies: - codeql/javascript-all: "*" diff --git a/.github/workflows/codeql.yml b/.github/workflows/codeql.yml deleted file mode 100644 index a9db2d1b..00000000 --- a/.github/workflows/codeql.yml +++ /dev/null @@ -1,111 +0,0 @@ -# For most projects, this workflow file will not need changing; you simply need -# to commit it to your repository. -# -# You may wish to alter this file to override the set of languages analyzed, -# or to provide custom queries or build logic. -# -# ******** NOTE ******** -# We have attempted to detect the languages in your repository. Please check -# the `language` matrix defined below to confirm you have the correct set of -# supported CodeQL languages. -# -name: "CodeQL Advanced" - -on: - push: - branches: - - main - pull_request: - branches: - - main - schedule: - - cron: '23 15 * * 0' - workflow_dispatch: - -jobs: - analyze: - name: Analyze (${{ matrix.language }}) - # Runner size impacts CodeQL analysis time. To learn more, please see: - # - https://gh.io/recommended-hardware-resources-for-running-codeql - # - https://gh.io/supported-runners-and-hardware-resources - # - https://gh.io/using-larger-runners (GitHub.com only) - # Consider using larger runners or machines with greater resources for - # possible analysis time improvements. - runs-on: ubuntu-latest - permissions: - # required for all workflows - security-events: write - - # required to fetch internal or private CodeQL packs - packages: read - - # only required for workflows in private repositories - actions: read - contents: read - - strategy: - fail-fast: false - matrix: - include: - - language: actions - build-mode: none - - language: javascript-typescript - build-mode: none - # CodeQL supports the following values keywords for 'language': - # 'actions', 'c-cpp', 'csharp', 'go', 'java-kotlin', - # 'javascript-typescript', 'python', 'ruby', 'rust', 'swift' - # Use `c-cpp` to analyze code written in C, C++ or both - # Use 'java-kotlin' to analyze code written in Java, Kotlin or both - # Use 'javascript-typescript' to analyze code written in JavaScript, - # TypeScript or both - # To learn more about changing the languages that are analyzed or - # customizing the build mode for your analysis, see - # https://docs.github.com/en/code-security/code-scanning/ - # creating-an-advanced-setup-for-code-scanning/ - # customizing-your-advanced-setup-for-code-scanning - # If you are analyzing a compiled language, you can modify the - # 'build-mode' for that language to customize how your codebase is - # analyzed, see https://docs.github.com/en/code-security/ - # code-scanning/creating-an-advanced-setup-for-code-scanning/ - # codeql-code-scanning-for-compiled-languages - steps: - - name: Checkout repository - uses: actions/checkout@v4 - - # Add any setup steps before running the `github/codeql-action/init` - # action. This includes steps like installing compilers or runtimes - # (`actions/setup-node` or others). This is typically only required - # for manual builds. - # - name: Setup runtime (example) - # uses: actions/setup-example@v1 - - # Initializes the CodeQL tools for scanning. - - name: Initialize CodeQL - uses: github/codeql-action/init@v4 - with: - languages: ${{ matrix.language }} - build-mode: ${{ matrix.build-mode }} - config-file: ./.github/codeql/codeql-config.yml - - # If the analyze step fails for one of the languages you are analyzing - # with "We were unable to automatically build your code", modify the - # matrix above to set the build mode to "manual" for that language. - # Then modify this step to build your code. - # ℹī¸ Command-line programs to run using the OS shell. - # 📚 See https://docs.github.com/en/actions/using-workflows/ - # workflow-syntax-for-github-actions#jobsjob_idstepsrun - - name: Run manual build steps - if: matrix.build-mode == 'manual' - shell: bash - run: | - echo 'If you are using a "manual" build mode for one or more of the' \ - 'languages you are analyzing, replace this with the commands to' \ - 'build your code, for example:' - echo ' make bootstrap' - echo ' make release' - exit 1 - - - name: Perform CodeQL Analysis - uses: github/codeql-action/analyze@v4 - with: - category: "/language:${{matrix.language}}" diff --git a/src/routes/admin/index.ts b/src/routes/admin/index.ts index dbfb9617..c52f149d 100644 --- a/src/routes/admin/index.ts +++ b/src/routes/admin/index.ts @@ -24,9 +24,9 @@ import { withAdminController } from '../../handlers/request-handlers/with-admin- const router: Router = Router() -// codeql[js/missing-rate-limiting] - custom Redis-backed sliding window rate limiter +// Custom Redis-backed sliding window rate limiter router.use(rateLimiterMiddleware) -// codeql[js/missing-rate-limiting] - feature gate only, not authentication +// Feature gate only, not authentication router.use(adminEnabledMiddleware) router.use('/assets', express.static('./resources/admin/assets')) router.get('/', getAdminDashboardRequestHandler) @@ -74,7 +74,6 @@ router.get( adminAuthMiddleware, withAdminController(createGetAdminSettingsSchemaController), ) -// codeql[js/missing-rate-limiting] - adminRateLimitMiddleware applies Redis-backed admin rate limits router.patch( '/settings', adminRateLimitMiddleware, @@ -83,7 +82,6 @@ router.patch( adminAuthMiddleware, withAdminController(createPatchAdminSettingsController), ) -// codeql[js/missing-rate-limiting] - adminRateLimitMiddleware applies Redis-backed admin rate limits router.post( '/settings/validate', adminRateLimitMiddleware, diff --git a/src/routes/index.ts b/src/routes/index.ts index 1c6f9a0b..d7ff1b50 100644 --- a/src/routes/index.ts +++ b/src/routes/index.ts @@ -15,7 +15,6 @@ import { hasExplicitNostrJsonAcceptHeader, rootRequestHandler } from '../handler const router: Router = express.Router() // Public NIP-11 / homepage — advertises relay metadata only; not an authentication endpoint. -// codeql[js/missing-rate-limiting] router.use((req, res, next) => { if (req.method === 'GET' && req.path === '/' && hasExplicitNostrJsonAcceptHeader(req)) { return rootRequestHandler(req, res, next) @@ -23,13 +22,11 @@ router.use((req, res, next) => { next() }) -// codeql[js/missing-rate-limiting] router.get('/', rootRequestHandler) // Liveness: process is running (always 200). Used for "is the container up?" checks. router.get('/healthz', getHealthRequestHandler) router.get('/privacy', getPrivacyRequestHandler) // Readiness: Postgres + Redis must respond. Used before routing traffic during deploys. -// codeql[js/missing-rate-limiting] router.get('/readyz', getReadyzRequestHandler) router.get('/terms', getTermsRequestHandler) From 35b5000790f8f16d138e0cead156988ecaeb2d6b Mon Sep 17 00:00:00 2001 From: ABHAY PANDEY Date: Wed, 9 Sep 2026 00:00:16 +0530 Subject: [PATCH 2/2] chore: add changeset for CodeQL removal --- .changeset/disable-codeql.md | 9 +++++++++ 1 file changed, 9 insertions(+) create mode 100644 .changeset/disable-codeql.md diff --git a/.changeset/disable-codeql.md b/.changeset/disable-codeql.md new file mode 100644 index 00000000..be1dc6ee --- /dev/null +++ b/.changeset/disable-codeql.md @@ -0,0 +1,9 @@ +--- +"nostream": patch +--- + +ci: disable CodeQL workflow + +Removes the CodeQL Advanced GitHub Actions workflow, custom query pack, config, +and route suppression comments to stop false-positive security alerts on admin +routes that already use custom auth and rate limiting.