Skip to content

Leftrightleft patch 1 #32

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
wants to merge 4 commits into
base: main
Choose a base branch
from
Open
Show file tree
Hide file tree
Changes from all commits
Commits
File filter

Filter by extension

Filter by extension

Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
2 changes: 1 addition & 1 deletion .github/steps/1-enable-codeql.md
Original file line number Diff line number Diff line change
Expand Up @@ -24,7 +24,7 @@ In this first step, we'll be learning more about CodeQL and how to use it to sec
First, we will enable code scanning with CodeQL in our repository.

1. Open a new browser tab, and work on the steps in your second tab while you read the instructions in this tab.
2. Navigate the to **Settings** tab at the top of your newly created repository.
2. Navigate to the **Settings** tab at the top of your newly created repository.
3. Under the **Security** section on the left side, select **Code security and analysis**.
4. Scroll down to the section titled **Code scanning**. For the purpose of this course, we will focus on CodeQL analysis.
5. Click on the **Set up** dropdown menu and choose **Default**.
Expand Down
2 changes: 1 addition & 1 deletion .github/steps/2-review-and-triage-codeql-alerts.md
Original file line number Diff line number Diff line change
Expand Up @@ -80,7 +80,7 @@ Now that we're familiar with the alert layout, let's work through the process of
### :keyboard: Activity 5: Create a GitHub Issue for an Alert
This last step will show you how to create a GitHub Issue to track the work that goes into resolving a vulnerability. Issues provide a space for collaboration for a security problem and can be assigned to people or teams.

1. Open one of the open alerts that CodeQL from the scan.
1. Open one of the open alerts identified by CodeQL during the scan.
2. Click the green **Create issue** button at the top right of the alert. If you don't see this button, check the status of the alert to make sure it's an open alert.
3. Add any details you would like to include in the new issue form.
4. Click **Submit new issue**.
Expand Down
Original file line number Diff line number Diff line change
Expand Up @@ -9,7 +9,7 @@

_Nicely done! You finished Step 3: Fix Security Vulnerabilites! :partying_face:_

Way to go! You made it this far. We're almost done! The last step is to test out the pull request integration with CodeQL. In this step, we will add a vulnerability back into the `routes.py` file to trigger an alert for a SQL injection vulnerability. This is going to be the same issue initially saw.
Way to go! You made it this far. We're almost done! The last step is to test out the pull request integration with CodeQL. In this step, we will add a vulnerability back into the `routes.py` file to trigger an alert for a SQL injection vulnerability. This is going to be the same issue we initially saw.

Our goal is to understand what developers experience when they find a new vulnerability.

Expand Down
2 changes: 1 addition & 1 deletion .github/steps/X-finish.md
Original file line number Diff line number Diff line change
Expand Up @@ -9,7 +9,7 @@ _Congratulations! You have completed this course!_ 🏆

Here's a recap of all the tasks you accomplished in your repository:
- Enabled CodeQL on your repository.
- CodeQL scanned the code in your repository and notified us of two SQL injection vulenrabilities.
- CodeQL scanned the code in your repository and notified us of two SQL injection vulnerabilities.
- Reviewed the findings, marked the findings as closed, and explored the audit trail.
- Fixed your code in the main branch and saw that the findings automatically closed out.
- Introduced a new vulnerability in a new branch.
Expand Down