ci: extend codeQL for backend HTTP requests

Draft
TA
3d ago
+699-0

Context & Requests for Reviewers

Tests

(Optional) Rollout Plan

Release notes

Checklist

Only check items that apply to this PR; leave the rest unchecked.

  • If you changed anything user-facing (i.e. user interface or APIs):
    Did you update related docs?

  • If the change is notable (refer to Keep a Changelog conventions):
    Did you fill in the Release notes section above?

  • If you changed db/src/scripts/** and used CREATE TABLE, ADD COLUMN, or ALTER COLUMN:
    Are as many columns marked NOT NULL as possible? If some columns can sometimes be null depending on other columns, are there CHECK constraints capturing those relationships, and are these also reflected using unions in the associated Kysely types?

  • If you added a new signal in server/services/signalsService/signals/**:
    Did you classify every error case as a permanent error (SignalPermanentError, no retry) or a normal error (retryable)? Any case where the signal can't determine a score should be a SignalPermanentError.

Summary by cubic

Adds a custom CodeQL query that reports paths from untrusted backend input to outbound fetchHTTP URL arguments, with native fixtures and a CI workflow that compiles and tests the query.

The query is advisory (recommendation severity) and flags likely exposure paths for manual review; it does not change request handling or confirm SSRF vulnerabilities.

  • Sources include Express input, Coop handler factories, typed GraphQL arguments, signal inputs, queue payloads, NCMEC media, and HTTP response bodies.
  • Sinks are url properties on the fetchHTTP call contract; recognition uses property/type names and local aliases rather than full BottleJS service resolution.
  • URL validation does not suppress findings; encoded path or query influence under a fixed host is reported alongside whole-URL influence.
  • Fixture tests use inline // $ hasUrlFlow expectations, covering direct calls, aliases, cross-file helpers, factories, workers, response sources, caching, and bound callbacks.
  • The workflow pins the CodeQL CLI 2.27.4 with a checksum, installs locked query dependencies, and runs only when query tooling or configuration changes.
  • The GitHub config file is included but must be activated by an organization administrator via the github-codeql-config-file repository property.