> ## Documentation Index
> Fetch the complete documentation index at: https://notes.kodekloud.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Demo GHAS CodeQL

> Guide to enabling GHAS CodeQL for Node.js, running CodeQL via GitHub Actions, reviewing code scanning alerts, and triaging common issues like path traversal and missing rate limiting

Enable CodeQL scanning for your repository and review the results for a Node.js (JavaScript/TypeScript) application using GitHub Advanced Security (GHAS).

This guide shows the high-level steps to:

* Enable CodeQL at the organization level in GitHub Enterprise Advanced Security.
* Let the default CodeQL setup run via GitHub Actions.
* Inspect CodeQL findings in the repository Security & Analysis -> Code scanning alerts.
* Triage and remediate typical Node.js issues such as path traversal and missing rate limiting.

Step 1 — Enable GHAS CodeQL at the organization level
Open your GitHub Enterprise settings, navigate to Advanced Security, and edit the organization Advanced Security configuration to enable code scanning (CodeQL) and other protections.

![A dark-themed screenshot of a GitHub Enterprise "Advanced Security" settings page for an organization called NextGen Gaming, showing security stats (Dependabot 0%, Code Security 0%, Secret Protection 100%) and configuration options.](https://mintcdn.com/kodekloud-c4ac6d9a/TlnHw4JjIHBx3Cta/images/GitHub-Administration-Certification/Security-and-Compliance/Demo-GHAS-CodeQL/github-enterprise-advanced-security-nextgen-gaming.jpg?fit=max\&auto=format\&n=TlnHw4JjIHBx3Cta\&q=85\&s=f4e64921885399912ccb22cead153b7c)

Within the Advanced Security configuration you can:

* Turn on secret scanning, push protection, and code scanning.
* Choose the CodeQL setup mode (default or advanced).
* Leave runner selection unset to allow repository/owner-level decisions, or select GitHub-hosted vs self-hosted runners.
* Enable options such as “prevent direct alert dismissal” to enforce tracked remediation.

![A screenshot of a GitHub Enterprise "Settings" page for the NextGen Gaming organization, showing the Advanced Security "Edit configuration" screen. The page lists configuration fields and secret protection options like secret scanning, validity checks, and push protection with their enabled/disabled states.](https://mintcdn.com/kodekloud-c4ac6d9a/TlnHw4JjIHBx3Cta/images/GitHub-Administration-Certification/Security-and-Compliance/Demo-GHAS-CodeQL/github-enterprise-advanced-security-secrets.jpg?fit=max\&auto=format\&n=TlnHw4JjIHBx3Cta\&q=85\&s=70127ff133ed4366eceb56ec89590407)

Some Advanced Security features (for example, Dependabot version updates and CodeQL code scanning) run using GitHub Actions and therefore consume GitHub Actions minutes. Keep that in mind when enabling organization-wide CodeQL analysis.

If you enable organization-wide CodeQL, repositories will inherit the default setup and trigger workflow runs automatically. Confirm runner selection and billing implications before enabling at scale.

Step 2 — Default CodeQL setup triggers a workflow run
After you save the organization-level configuration, repositories covered by the setting will trigger the default CodeQL setup. This creates a GitHub Actions workflow that initializes CodeQL and runs analysis for the languages detected (for example, JavaScript/TypeScript).

![A GitHub Actions workflow run page showing "CodeQL Setup" for a repository. The "Analyze (javascript-typescript)" job is displayed with a checklist of steps (Set up job, Checkout repository, Initialize CodeQL, Perform CodeQL Analysis, etc.).](https://mintcdn.com/kodekloud-c4ac6d9a/TlnHw4JjIHBx3Cta/images/GitHub-Administration-Certification/Security-and-Compliance/Demo-GHAS-CodeQL/github-actions-codeql-analyze-js-ts.jpg?fit=max\&auto=format\&n=TlnHw4JjIHBx3Cta\&q=85\&s=a1a4119b8c3fdde1a7fc06bc808476a0)

Step 3 — Review CodeQL results in Security & Analysis
When the workflow completes, go to the repository’s Security & Analysis (Security and Quality) -> Code scanning alerts. CodeQL lists alerts with metadata (severity, detection time, affected branch). Clicking an alert shows the file and line, the weakness description, remediation guidance, and often code examples. You can assign alerts, link them to issues, or create a branch to fix the code.

Common CodeQL alert types for Node.js

| Alert type | Description | Typical remediation |
| - | - | - |
| Path traversal / unsafe file access | Unvalidated user input used to build file paths (e.g., `path.join(__dirname, 'public', userInput)`) | Constrain path resolution using `res.sendFile(..., { root })`, validate input, or use whitelists |
| Missing rate limiting | Endpoints that accept user input without rate limiting, leading to DoS | Add throttling middleware (e.g., `express-rate-limit`) |
| Injection (command, SQL, or template) | Unsanitized input passed to shell commands, database queries, or template engines | Use parameterized APIs or strong sanitization and escaping |
| Sensitive data exposure | Hardcoded secrets or secrets leaking in logs | Use secret scanning and rotate exposed keys |

Vulnerable example: unsafe path resolution
This minimal Express example demonstrates the pattern CodeQL typically flags: directly joining unvalidated user input into a filesystem path.

```javascript theme={null}
// Vulnerable path resolution (unsafe) - Express example
const express = require('express');
const path = require('path');
const app = express();
const PORT = process.env.PORT || 3000;

app.get('/download/:filename', (req, res) => {
  const filename = req.params.filename;
  // Unsafe: directly join unvalidated user input into a file path
  const unsafePath = path.join(__dirname, 'public', filename);
  res.sendFile(unsafePath);
});

app.listen(PORT, () => {
  console.log(`Server listening on ${PORT}`);
});
```

Why this is dangerous
If `filename` contains traversal sequences (for example `../../etc/passwd`), the server may send files outside the intended directory. CodeQL flags this pattern as a path traversal/uncontrolled data in path expression.

Safer alternatives

* Use `res.sendFile()` with the `root` option to constrain file lookup to a known directory.
* Normalize and validate filenames (e.g., `path.basename`, verify resolved path is within the allowed root).
* Prefer whitelisting allowed filenames or mapping IDs to stored files rather than accepting arbitrary filenames.

Example: using `root` (recommended when serving from a known directory)

```javascript theme={null}
const safeRoot = path.join(__dirname, 'public');

app.get('/download/:filename', (req, res) => {
  const filename = req.params.filename;
  // sendFile with `root` ensures lookup is constrained to safeRoot
  res.sendFile(filename, { root: safeRoot }, (err) => {
    if (err) {
      res.status(err.status || 500).send('File not found or access denied');
    }
  });
});
```

Example: explicit validation of the resolved path

```javascript theme={null}
const safeRoot = path.join(__dirname, 'public');

app.get('/download/:filename', (req, res) => {
  const raw = req.params.filename;
  // Remove any directory components to prevent obvious traversal attempts
  const basename = path.basename(raw);
  const resolved = path.resolve(safeRoot, basename);

  // Ensure resolved path is inside safeRoot
  const safeRootResolved = path.resolve(safeRoot);
  if (!resolved.startsWith(safeRootResolved + path.sep) && resolved !== safeRootResolved) {
    return res.status(400).send('Invalid filename');
  }

  res.sendFile(resolved, (err) => {
    if (err) {
      res.status(err.status || 500).send('File not found or access denied');
    }
  });
});
```

Triage workflow tips

* Start by reviewing the CodeQL alert description and the file/line context provided.
* Prioritize high-severity alerts and those affecting protected branches.
* Use CodeQL remediation guidance and the example fixes to create pull requests.
* Assign the alert to the developer or team responsible and link to a tracking issue if needed.

Resources and further reading

* GitHub Advanced Security (GHAS) — [https://docs.github.com/en/enterprise-server@latest/code-security](https://docs.github.com/en/enterprise-server@latest/code-security)
* CodeQL code scanning — [https://codeql.github.com/](https://codeql.github.com/) and [https://docs.github.com/code-security/secure-coding](https://docs.github.com/code-security/secure-coding)
* Node.js security best practices — [https://nodejs.org/en/docs/guides/security](https://nodejs.org/en/docs/guides/security)
* Express documentation (`res.sendFile`) — [https://expressjs.com/en/4x/api.html#res.sendFile](https://expressjs.com/en/4x/api.html#res.sendFile)

CodeQL alerts typically include remediation guidance, sample fixes, and links to documentation. Use those resources along with file-level details to triage, assign, and remediate vulnerabilities effectively.

> [card] [Watch Video](https://learn.kodekloud.com/user/courses/github-administration-certification/module/d477d0b2-5ca0-43b2-aed7-7d82887400f7/lesson/7cc3fc03-fc59-4585-ae6e-573ca6595498)


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.