Demo GHAS CodeQL

Enable CodeQL scanning for your repository and review the results for a Node.js (JavaScript/TypeScript) application using GitHub Advanced Security (GHAS). This guide shows the high-level steps to:

Enable CodeQL at the organization level in GitHub Enterprise Advanced Security.
Let the default CodeQL setup run via GitHub Actions.
Inspect CodeQL findings in the repository Security & Analysis -> Code scanning alerts.
Triage and remediate typical Node.js issues such as path traversal and missing rate limiting.

Step 1 — Enable GHAS CodeQL at the organization level Open your GitHub Enterprise settings, navigate to Advanced Security, and edit the organization Advanced Security configuration to enable code scanning (CodeQL) and other protections.

A dark-themed screenshot of a GitHub Enterprise "Advanced Security" settings page for an organization called NextGen Gaming, showing security stats (Dependabot 0%, Code Security 0%, Secret Protection 100%) and configuration options.

Within the Advanced Security configuration you can:

Turn on secret scanning, push protection, and code scanning.
Choose the CodeQL setup mode (default or advanced).
Leave runner selection unset to allow repository/owner-level decisions, or select GitHub-hosted vs self-hosted runners.
Enable options such as “prevent direct alert dismissal” to enforce tracked remediation.

A screenshot of a GitHub Enterprise "Settings" page for the NextGen Gaming organization, showing the Advanced Security "Edit configuration" screen. The page lists configuration fields and secret protection options like secret scanning, validity checks, and push protection with their enabled/disabled states.

Some Advanced Security features (for example, Dependabot version updates and CodeQL code scanning) run using GitHub Actions and therefore consume GitHub Actions minutes. Keep that in mind when enabling organization-wide CodeQL analysis.

If you enable organization-wide CodeQL, repositories will inherit the default setup and trigger workflow runs automatically. Confirm runner selection and billing implications before enabling at scale.

Step 2 — Default CodeQL setup triggers a workflow run After you save the organization-level configuration, repositories covered by the setting will trigger the default CodeQL setup. This creates a GitHub Actions workflow that initializes CodeQL and runs analysis for the languages detected (for example, JavaScript/TypeScript).

A GitHub Actions workflow run page showing "CodeQL Setup" for a repository. The "Analyze (javascript-typescript)" job is displayed with a checklist of steps (Set up job, Checkout repository, Initialize CodeQL, Perform CodeQL Analysis, etc.).

Step 3 — Review CodeQL results in Security & Analysis When the workflow completes, go to the repository’s Security & Analysis (Security and Quality) -> Code scanning alerts. CodeQL lists alerts with metadata (severity, detection time, affected branch). Clicking an alert shows the file and line, the weakness description, remediation guidance, and often code examples. You can assign alerts, link them to issues, or create a branch to fix the code. Common CodeQL alert types for Node.js

Alert type	Description	Typical remediation
Path traversal / unsafe file access	Unvalidated user input used to build file paths (e.g., `path.join(__dirname, 'public', userInput)`)	Constrain path resolution using `res.sendFile(..., { root })`, validate input, or use whitelists
Missing rate limiting	Endpoints that accept user input without rate limiting, leading to DoS	Add throttling middleware (e.g., `express-rate-limit`)
Injection (command, SQL, or template)	Unsanitized input passed to shell commands, database queries, or template engines	Use parameterized APIs or strong sanitization and escaping
Sensitive data exposure	Hardcoded secrets or secrets leaking in logs	Use secret scanning and rotate exposed keys

Vulnerable example: unsafe path resolution This minimal Express example demonstrates the pattern CodeQL typically flags: directly joining unvalidated user input into a filesystem path.

// Vulnerable path resolution (unsafe) - Express example
const express = require('express');
const path = require('path');
const app = express();
const PORT = process.env.PORT || 3000;

app.get('/download/:filename', (req, res) => {
  const filename = req.params.filename;
  // Unsafe: directly join unvalidated user input into a file path
  const unsafePath = path.join(__dirname, 'public', filename);
  res.sendFile(unsafePath);
});

app.listen(PORT, () => {
  console.log(`Server listening on ${PORT}`);
});

Why this is dangerous If filename contains traversal sequences (for example ../../etc/passwd), the server may send files outside the intended directory. CodeQL flags this pattern as a path traversal/uncontrolled data in path expression. Safer alternatives

Use res.sendFile() with the root option to constrain file lookup to a known directory.
Normalize and validate filenames (e.g., path.basename, verify resolved path is within the allowed root).
Prefer whitelisting allowed filenames or mapping IDs to stored files rather than accepting arbitrary filenames.

Example: using root (recommended when serving from a known directory)

const safeRoot = path.join(__dirname, 'public');

app.get('/download/:filename', (req, res) => {
  const filename = req.params.filename;
  // sendFile with `root` ensures lookup is constrained to safeRoot
  res.sendFile(filename, { root: safeRoot }, (err) => {
    if (err) {
      res.status(err.status || 500).send('File not found or access denied');
    }
  });
});

Example: explicit validation of the resolved path

const safeRoot = path.join(__dirname, 'public');

app.get('/download/:filename', (req, res) => {
  const raw = req.params.filename;
  // Remove any directory components to prevent obvious traversal attempts
  const basename = path.basename(raw);
  const resolved = path.resolve(safeRoot, basename);

  // Ensure resolved path is inside safeRoot
  const safeRootResolved = path.resolve(safeRoot);
  if (!resolved.startsWith(safeRootResolved + path.sep) && resolved !== safeRootResolved) {
    return res.status(400).send('Invalid filename');
  }

  res.sendFile(resolved, (err) => {
    if (err) {
      res.status(err.status || 500).send('File not found or access denied');
    }
  });
});

Triage workflow tips

Start by reviewing the CodeQL alert description and the file/line context provided.
Prioritize high-severity alerts and those affecting protected branches.
Use CodeQL remediation guidance and the example fixes to create pull requests.
Assign the alert to the developer or team responsible and link to a tracking issue if needed.

Resources and further reading

GitHub Advanced Security (GHAS) — https://docs.github.com/en/enterprise-server@latest/code-security
CodeQL code scanning — https://codeql.github.com/ and https://docs.github.com/code-security/secure-coding
Node.js security best practices — https://nodejs.org/en/docs/guides/security
Express documentation (res.sendFile) — https://expressjs.com/en/4x/api.html#res.sendFile

CodeQL alerts typically include remediation guidance, sample fixes, and links to documentation. Use those resources along with file-level details to triage, assign, and remediate vulnerabilities effectively.

Course Introduction

Foundation Setup

Identity and Access Management

Governance and Roles

Security and Compliance

GitHub Actions and Runners

Administration and Support

Monitoring and Optimization

Watch Video