Suppress warnings from Github

[leoluz]

Hi!
I am trying to suppress a warning from what I understand a false positive zip-slip validation. We are using the GitHub Code Scanning job for running CodeQL. Even when I add the // lgtm[go/zipslip] tag in the code I still get the warning.

Example case:
https://github.com/argoproj/argo-cd/pull/8789/checks?check_run_id=5574205353

Is // lgtm tags supported by Github Code Scanning jobs? If not, how could I suppress warnings in this case?

Thank you!

[leoluz]

By the way, the false positive warning is pointing this line complaining about unsanitized target variable. However the sanitization code is applied by the Inbound function called a few lines above. It seems the zipslip validation isn't able to follow that function. Sorry but this is just a guess as I don't know how codeql query works. If I copy the code from Inbound inside the caller function the warning goes away.

[aibaars]

Alert suppression using //lgtm or otherwise is not supported by GitHub Code Scanning.

@smowton Could you have a look at this? At a glance the sanitization code looks fine. Should the query be updated to recognize the sanitization code ?

[smowton]

It'll be difficult to accurately classify https://github.com/argoproj/argo-cd/blob/77f9515547096ea939dd8b0b3aeae77708f11795/util/io/files/util.go#L80 as a barrier guard. Manually dismissing the warning is probably right in this case. @aibaars can you advise how to do that?

[aibaars]

Manually dismissing the warning is probably right in this case. @aibaars can you advise how to do that?

Manually dismissing can be done in the UI.

[leoluz]

Tks all for confirming this.
We dismissed from the UI but I was wondering if there is a declarative way of doing it like using the // lgtm[] tag but that didn't work for me.

[smowton]

Closing as answered: no there isn't an inline comment mechanism for suppression in current code scanning, but manual dismissal via the UI can be done.

[aibaars]

You may want to use https://github.com/advanced-security/dismiss-alerts to automate the task of dismissing alerts that have suppression markers in the code.