<!DOCTYPE html>
<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=UTF-8">
</head>
<body>
<p>Thanks a lot for you insights Even!</p>
<p>Ok then, this is way beyond my skills and available time, let's
forget this naive approach. And let's plant a seed. Any Grant
proposal toward enabling code scanning would be probably more than
welcome. <br>
</p>
<p>I know some of you are trying to gather funding to approach the
security globally. If plans are already made, please express
yourselves here. As a person in charge of responding to security
inquiries, I need some visibility here. <br>
</p>
<p>Best regards <br>
</p>
<p>Régis<br>
</p>
<div class="moz-cite-prefix">Le 13/11/2024 à 12:03, Even Rouault a
écrit :<br>
</div>
<blockquote type="cite"
cite="mid:c4923ef4-a800-4a16-b547-4ef92021b4b2@spatialys.com">Régis,
<br>
<br>
you will probably need a bit more work than just pushing the
default button, as it will likely generate a default codeql.yml
file that won't work out-of-the-box on QGIS without tuning it.
You'll need first to install the list of QGIS dependencies to get
a successful build. Cf
<a class="moz-txt-link-freetext" href="https://github.com/OSGeo/gdal/blob/master/.github/workflows/codeql.yml">https://github.com/OSGeo/gdal/blob/master/.github/workflows/codeql.yml</a>
for an example on GDAL. We disabled Python scanning, as 99% of
Python is in our test suite and I didn't want to be spammed about
warnings in non-production code. Turned on a large code base like
QGIS, be ready to see several hundreds of warnings popping up. In
GDAL, one of the most recurring category was about "Multiplication
result converted to larger type", ie doing something like int64_t
var = some_int_32_var * another_int_32_var. Another thing I
noticed with CodeQL is that it seems to limit the analysis to a
max number of files, more or less randomly chosen depending on
builds. So while we have it enabled for pull requests, in some
cases, it missed new warnings specific on the PR during the review
of the PR, but it then analyzed the modified files during a run in
master. As QGIS is larger than GDAL, I would expect that to happen
for QGIS too. That said, there's probably no harm in enabling it
as the number or detail of warnings is only visible to users with
write privileges to the repository
<br>
<br>
Even
<br>
<br>
Le 13/11/2024 à 09:58, Régis Haubourg via QGIS-Developer a écrit :
<br>
<blockquote type="cite">
<br>
Hi all,
<br>
<br>
the security requirements of IT departments keeps on growing and
we receive more and more requests on the security mail.
<br>
<br>
The topic is broad, from filling in custom forms based on
various national or company-specific policies, to very precise
vulnerability scanning, or even ask us what we do to prevent
XZ-like social engineering attacks.
<br>
<br>
To get a better score on good practices [0], a simple first step
would be to activate code scanning. Github provides CodeQL [1]
for free. I would like to activate it and see how it goes.
<br>
<br>
Would you be OK with activating this and see how it goes (too
much spamming, limitations on our codebase, more advanced
configuration required etc... ) ?
<br>
<br>
In case of no reaction, I'll push the button on friday and see
what happens :)
<br>
<br>
<br>
@lova @Tim, we probably should do similar things for our
websites, we have some bounty seekers raising disclosures on our
websites. I'd prefer that we catch those CVE earlier than have
to deal with some of those anonymous persons.
<br>
<br>
<br>
Thanks a lot !
<br>
<br>
Régis
<br>
<br>
<br>
[0]
<a class="moz-txt-link-freetext" href="https://securityscorecards.dev/viewer/?uri=github.com/qgis/QGIS">https://securityscorecards.dev/viewer/?uri=github.com/qgis/QGIS</a>
<br>
<br>
[1] <a class="moz-txt-link-freetext" href="https://codeql.github.com/">https://codeql.github.com/</a>
<br>
<br>
<br>
_______________________________________________
<br>
QGIS-Developer mailing list
<br>
<a class="moz-txt-link-abbreviated" href="mailto:QGIS-Developer@lists.osgeo.org">QGIS-Developer@lists.osgeo.org</a>
<br>
List info:
<a class="moz-txt-link-freetext" href="https://lists.osgeo.org/mailman/listinfo/qgis-developer">https://lists.osgeo.org/mailman/listinfo/qgis-developer</a>
<br>
Unsubscribe:
<a class="moz-txt-link-freetext" href="https://lists.osgeo.org/mailman/listinfo/qgis-developer">https://lists.osgeo.org/mailman/listinfo/qgis-developer</a>
<br>
</blockquote>
<br>
</blockquote>
<div id="grammalecte_menu_main_button_shadow_host"
style="width: 0px; height: 0px;"></div>
</body>
</html>