Configure CodeQL to exclude Python-based URL redirect false positives #11677

New Issue

adam · 2025-12-29T21:48:32+01:00

adam commented

2025-12-29 21:48:32 +01:00

Originally created by @jnovinger on GitHub (Oct 2, 2025).

Originally assigned to: @jnovinger on GitHub.

Proposed Changes

Add query filter to CodeQL configuration to exclude the py/url-redirection query, which is generating 24 false positive alerts.

Update .github/codeql/codeql-config.yml:

...

query-filters:
  # Exclude py/url-redirection: NetBox uses safe_for_redirect() wrapper function
  # which validates all redirects via Django's url_has_allowed_host_and_scheme().
  # CodeQL's taint tracking doesn't recognize wrapper functions without custom
  # query configuration.
  - exclude:
      id: py/url-redirection

Justification

CodeQL is flagging 24 URL redirect alerts across the codebase. Each uses either safe_for_redirect() or get_return_url() (which calls safe_for_redirect() internally). These are false positives.

The issue is that safe_for_redirect() wraps Django's url_has_allowed_host_and_scheme(), and CodeQL's taint tracking doesn't recognize wrapper functions as sanitizers. It sees tainted input flow into the wrapper and back out to redirect(), but doesn't understand that validation happened inside. Custom CodeQL queries to fix this aren't available with GitHub-hosted scanning.

NetBox's implementation is secure. safe_for_redirect() uses allowed_hosts=None, which only permits relative URLs (no external redirects). Since we consistently use this wrapper for all redirects, the risk of introducing actual vulnerabilities is minimal while the query generates nothing but noise.

Excluding this query will auto-dismiss the 24 existing alerts and prevent future false positives.

Originally created by @jnovinger on GitHub (Oct 2, 2025). Originally assigned to: @jnovinger on GitHub. ### Proposed Changes Add query filter to CodeQL configuration to exclude the `py/url-redirection` query, which is generating 24 false positive alerts. Update `.github/codeql/codeql-config.yml`: ```yaml ... query-filters: # Exclude py/url-redirection: NetBox uses safe_for_redirect() wrapper function # which validates all redirects via Django's url_has_allowed_host_and_scheme(). # CodeQL's taint tracking doesn't recognize wrapper functions without custom # query configuration. - exclude: id: py/url-redirection ``` ### Justification CodeQL is flagging 24 URL redirect alerts across the codebase. Each uses either `safe_for_redirect()` or `get_return_url()` (which calls `safe_for_redirect()` internally). These are false positives. The issue is that `safe_for_redirect()` wraps Django's `url_has_allowed_host_and_scheme()`, and CodeQL's taint tracking doesn't recognize wrapper functions as sanitizers. It sees tainted input flow into the wrapper and back out to `redirect()`, but doesn't understand that validation happened inside. Custom CodeQL queries to fix this aren't available with GitHub-hosted scanning. NetBox's implementation is secure. `safe_for_redirect()` uses `allowed_hosts=None`, which only permits relative URLs (no external redirects). Since we consistently use this wrapper for all redirects, the risk of introducing actual vulnerabilities is minimal while the query generates nothing but noise. Excluding this query will auto-dismiss the 24 existing alerts and prevent future false positives.

adam added the status: accepted type: housekeeping labels 2025-12-29 21:48:32 +01:00

adam closed this issue

2025-12-29 21:48:32 +01:00

Sign in to join this conversation.

Branches Tags

main

update-changelog-comments-docs

feature-removal-issue-type

20911-dropdown

20239-plugin-menu-classes-mutable-state

21097-graphql-id-lookups

feature

fix_module_substitution

20923-dcim-templates

20044-elevation-stuck-lightmode

feature-ip-prefix-link

v4.5-beta1-release

20068-import-moduletype-attrs

20766-fix-german-translation-code-literals

20378-del-script

7604-filter-modifiers-v3

circuit-swap

12318-case-insensitive-uniqueness

20637-improve-device-q-filter

20660-script-load

19724-graphql

20614-update-ruff

14884-script

02496-max-page

19720-macaddress-interface-generic-relation

19408-circuit-terminations-export-templates

20203-openapi-check

fix-19669-api-image-download

7604-filter-modifiers

19275-fixes-interface-bulk-edit

fix-17794-get_field_value_return_list

11507-show-aggregate-and-rir-on-api

9583-add_column_specific_search_field_to_tables

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: starred/netbox#11677