You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
The first step is always the hardest, so pick something easy!
5
-
Link to docs.github.com for further explanations.
6
-
Encourage users to open new tabs for steps!
7
-
TBD-step-1-notes.
8
-
-->
9
-
10
1
## Step 1: Enable CodeQL
11
2
12
-
👋 Hello! Welcome to the GitHub Skills course: Enable code scanning!
3
+
In this first step, we'll be learning more about CodeQL and how to use it to secure your source code.
4
+
5
+
### What is GitHub code scanning?
13
6
14
-
Let's get started!
7
+
[Code scanning](https://docs.github.com/en/code-security/code-scanning/automatically-scanning-your-code-for-vulnerabilities-and-errors/about-code-scanning) is a capability that allows development teams to integrate security testing tools into the software development process. This is done using GitHub Actions. With code scanning, you can integrate many different types of tools including SAST, container, and infrastructure as code security tools.
15
8
16
-
In this first step, we'll be learning more about CodeQL and how to use it to secure your source code.
9
+
### What is CodeQL?
17
10
18
-
**What is GitHub code scanning**: _[Code scanning](https://docs.github.com/en/code-security/code-scanning/automatically-scanning-your-code-for-vulnerabilities-and-errors/about-code-scanning)_ is a capability that allows development teams to integrate security testing tools into the software development process. This is done using GitHub Actions. With code scanning, you can integrate many different types of tools including SAST, container, and infrastructure as code security tools.
11
+
[CodeQL](https://docs.github.com/en/code-security/code-scanning/automatically-scanning-your-code-for-vulnerabilities-and-errors/about-code-scanning-with-codeql) is a static analysis testing tool that helps you identify security weaknesses such as SQL injection, cross-site scripting, and code injection issues.
19
12
20
-
**What is CodeQL**: _[CodeQL](https://docs.github.com/en/code-security/code-scanning/automatically-scanning-your-code-for-vulnerabilities-and-errors/about-code-scanning-with-codeql)_ is a static analysis testing tool that helps you identify security weaknesses such as SQL injection, cross-site scripting, and code injection issues.
13
+
### ⌨️ Activity: Enable code scanning with CodeQL
21
14
22
-
### :keyboard: Activity: Enable code scanning with CodeQL
23
-
24
15
First, we will enable code scanning with CodeQL in our repository.
25
16
26
17
1. Open a new browser tab, and work on the steps in your second tab while you read the instructions in this tab.
27
-
2. Navigate to the **Settings** tab at the top of your newly created repository.
28
-
3. Under the **Security** section on the left side, select **Code security and analysis**.
29
-
4. Scroll down to the section titled **Code scanning**. For the purpose of this course, we will focus on CodeQL analysis.
30
-
5. Click on the **Set up** dropdown menu and choose **Default**.
Let's take a look at the configuration options in the modal:
34
-
35
-
-**Languages to analyze:** These are the languages that will be scanned by CodeQL. In this case, we will be scanning in `Python`.
36
-
-**Query suites:** CodeQL [queries](https://docs.github.com/en/code-security/code-scanning/automatically-scanning-your-code-for-vulnerabilities-and-errors/about-code-scanning-with-codeql#about-codeql-queries) are packaged in bundles called "suites". This section allows you to choose which query suite to use. We'll leave this set as **Default** for this exercise. For more information, see "[About CodeQL queries](https://docs.github.com/en/code-security/code-scanning/automatically-scanning-your-code-for-vulnerabilities-and-errors/about-code-scanning-with-codeql#about-codeql-queries)."
37
-
-**Events:** This section tells CodeQL when to scan. In this case, it's set to scan on any pull request to the `main` branch.
7. Wait about 20 seconds then refresh this page (the one you're following instructions from). [GitHub Actions](https://docs.github.com/en/actions) will automatically update to the next step.
18
+
19
+
1. Navigate to the **Settings** tab at the top of your newly created repository.
20
+
21
+
1. Under the **Security** section on the left side, select **Code security and analysis**.
22
+
23
+
1. Scroll down to the section titled **Code scanning**. For the purpose of this exercise, we will focus on CodeQL analysis.
24
+
25
+
1. Click on the **Set up** dropdown menu and choose **Default**.
Let's take a look at the configuration options in the modal:
29
+
30
+
-**Languages to analyze:** These are the languages that will be scanned by CodeQL. In this case, we will be scanning in `Python`.
31
+
-**Query suites:** CodeQL [queries](https://docs.github.com/en/code-security/code-scanning/automatically-scanning-your-code-for-vulnerabilities-and-errors/about-code-scanning-with-codeql#about-codeql-queries) are packaged in bundles called "suites". This section allows you to choose which query suite to use. We'll leave this set as **Default** for this exercise. For more information, see "[About CodeQL queries](https://docs.github.com/en/code-security/code-scanning/automatically-scanning-your-code-for-vulnerabilities-and-errors/about-code-scanning-with-codeql#about-codeql-queries)."
32
+
-**Events:** This section tells CodeQL when to scan. In this case, it's set to scan on any pull request to the `main` branch.
Start this step by acknowledging the previous step.
4
-
Define terms and link to docs.github.com.
5
-
TBD-step-2-notes.
6
-
-->
7
-
8
1
## Step 2: Review and Triage CodeQL Alerts
9
2
10
-
_Way to go! You got CodeQL running! :tada:_
3
+
Now we will review the CodeQL scan results, triage an alert, and create a GitHub issue to track an alert.
4
+
5
+
### What is GitHub Actions
6
+
7
+
GitHub Actions is the automation and CI/CD platform within GitHub. We use GitHub Actions to orchestrate and execute security scans with code scanning. GitHub Actions is a continuous integration and continuous delivery (CI/CD) platform that allows you to automate your build, test, and deployment pipeline. For more information on GitHub Actions, see "[Understanding GitHub Actions](https://docs.github.com/en/actions/learn-github-actions/understanding-github-actions)."
11
8
12
-
In this exercise, we'll review the CodeQL scan results, triage an alert, and create a GitHub issue to track an alert.
9
+
### What is CWE
13
10
14
-
**What is GitHub Actions**: GitHub Actions is the automation and CI/CD platform within GitHub. We use GitHub Actions to orchestrate and execute security scans with code scanning. GitHub Actions is a continuous integration and continuous delivery (CI/CD) platform that allows you to automate your build, test, and deployment pipeline. For more information on GitHub Actions, see "[Understanding GitHub Actions](https://docs.github.com/en/actions/learn-github-actions/understanding-github-actions)."
11
+
Common Weakness Enumeration (CWE) is a category system for hardware and software weaknesses and vulnerabilities. Think of it as a way to describe and categorize security issues in an application's source code. For more information on CWEs, see the Wikipedia article "[Common Weakness Enumeration](https://en.wikipedia.org/wiki/Common_Weakness_Enumeration)."
15
12
16
-
**What is CWE**: Common Weakness Enumeration (CWE) is a category system for hardware and software weaknesses and vulnerabilities. Think of it as a way to describe and categorize security issues in an application's source code. For more information on CWEs, see the Wikipedia article "[Common Weakness Enumeration](https://en.wikipedia.org/wiki/Common_Weakness_Enumeration)."
13
+
### ⌨️ Activity: View the status of a CodeQL scan
17
14
18
-
### :keyboard: Activity 1: View the status of a CodeQL scan
15
+
In this activity, we'll explore GitHub Actions to view the status of a CodeQL scan.
19
16
20
-
In this activity, we'll explore GitHub Actions to view the status of a CodeQL scan.
21
17
1. In your new repository, go to your Actions page by selecting **Actions** from the top navigation bar. If the CodeQL Action run is still executing, you will see a yellow spinner indicating the scan is still in progress. This typically takes about 4 minutes to complete.
22
-
2. Select the run by clicking on **CodeQL Setup**.
23
18
24
-
19
+
1. Select the run by clicking on **CodeQL Setup**.
20
+
21
+
22
+
23
+
Notice that more information is available inside the Actions run. Feel free to explore this section to view information such as the CodeQL logs, duration, status, and artifacts generated by CodeQL.
25
24
26
-
Notice that more information is available inside the Actions run. Feel free to explore this section to view information such as the CodeQL logs, duration, status, and artifacts generated by CodeQL.
25
+
Once the scan is complete, a green check will show next to the execution.
27
26
28
-
Once the scan is complete, a green check will show next to the execution.
29
-
30
-
### :keyboard: Activity 2: View all CodeQL Alerts
27
+
### ⌨️ Activity: View all CodeQL Alerts
31
28
32
-
In this activity, we will view the CodeQL findings in the Security page of your repository. The Security page is where all security related information is displayed.
29
+
In this activity, we will view the CodeQL findings in the Security page of your repository. The Security page is where all security related information is displayed.
33
30
34
-
1. Navigate to the **Security** tab in the top navigation bar of your repository.
35
-
2. Select **Code scanning** under the "Vulnerability alerts" heading in left-side navigation bar.
31
+
1. Navigate to the **Security** tab in the top navigation bar of your repository.
36
32
37
-
This screen will contain all the vulnerabilities identified by CodeQL inside this repository's codebase. Explore the different filters and search capabilities in this page. These filtering capabilities become very helpful when you're working with many findings!
33
+
1. Select **Code scanning** under the "Vulnerability alerts" heading in left-side navigation bar.
38
34
35
+
This screen will contain all the vulnerabilities identified by CodeQL inside this repository's codebase. Explore the different filters and search capabilities in this page. These filtering capabilities become very helpful when you're working with many findings!
39
36
40
-
### :keyboard: Activity 3: Review an Alert
37
+
### ⌨️ Activity 3: Review an Alert
41
38
42
-
In this activity, we will explore the alert UI. We'll review the data flow of the vulnerability, indentify what part of the code the alert impacts, and get more information about the alert.
39
+
In this activity, we will explore the alert UI. We'll review the data flow of the vulnerability, identify what part of the code the alert impacts, and get more information about the alert.
43
40
44
41
**Alert status:** This section displays the current alert status (open or closed), identifies the branch where the scan detected the alert, and shows the timestamp of the alert.
45
-
42
+
46
43
47
44
48
-
**Location information:** This section describes which part of the code is vulnerable.
49
-
45
+
**Location information:** This section describes which part of the code is vulnerable.
**Paths:** Clicking on "Show paths" will give you additional insights into the alert's data flow. The modal shows us where the user input (we call that a "source") flows through the application until it's acted on (we call this the "sink"). This visualizes the flow of data through your application.
53
-
49
+
**Paths:** Clicking on "Show paths" will give you additional insights into the alert's data flow. The modal shows us where the user input (we call that a "source") flows through the application until it's acted on (we call this the "sink"). This visualizes the flow of data through your application.
50
+
54
51
**Recommendations:** This section provides a quick overview of the tool (CodeQL in this case), Rule ID, and even allows you to view the CodeQL query used to find this vulnerability. You can view the query by clicking **View source**. Additionally, this pane includes recommendations for fixing this vulnerability. Click **Show more** to view the full recommendation.
55
52
56
53
@@ -62,27 +59,38 @@ In this activity, we will explore the alert UI. We'll review the data flow of th
62
59
**Alert triage:** Use the buttons at the top right of the alert to triage or create a new issue for the alert. Don't do anything yet. We'll get into these buttons in a moment. 😄
63
60
64
61
**Additional info:** Finally, the right-side panel contains information such as tags, CWE information, and the severity of the alert
7. (Optional) You can also reopen the alert by opening it, then selecting **Reopen alert**.
80
+
1. (Optional) You can also reopen the alert by opening it, then selecting **Reopen alert**.
81
+
82
+
### ⌨️ Activity: Create a GitHub Issue for an Alert
79
83
80
-
### :keyboard: Activity 5: Create a GitHub Issue for an Alert
81
84
This last step will show you how to create a GitHub Issue to track the work that goes into resolving a vulnerability. Issues provide a space for collaboration for a security problem and can be assigned to people or teams.
82
-
85
+
83
86
1. Open one of the open alerts that CodeQL identified from the scan.
84
-
2. Click the green **Create issue** button at the top right of the alert. If you don't see this button, check the status of the alert to make sure it's an open alert.
85
-
3. Add any details you would like to include in the new issue form.
86
-
4. Click **Submit new issue**.
87
-
5. To view the your issue, click **Issues** in the top navigation bar of your repository.
88
-
6. Wait about 20 seconds then refresh this page (the one you're following instructions from). [GitHub Actions](https://docs.github.com/en/actions) will automatically update to the next step.
87
+
88
+
1. Click the green **Create issue** button at the top right of the alert. If you don't see this button, check the status of the alert to make sure it's an open alert.
89
+
90
+
1. Add any details you would like to include in the new issue form.
91
+
92
+
1. Click **Submit new issue**.
93
+
94
+
1. To view the your issue, click **Issues** in the top navigation bar of your repository.
95
+
96
+
1. With the new issue opened for managing the fix, Mona will check your progress and share the next steps.
0 commit comments