Skip to content

Commit e236f04

Browse files
authored
chore: Convert images to absolute urls on GitHub instead of embedding in repo
1 parent b4e6cf1 commit e236f04

16 files changed

+13
-13
lines changed

.github/steps/1-enable-codeql.md

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -23,15 +23,15 @@ First, we will enable code scanning with CodeQL in our repository.
2323
1. Scroll down to the section titled **Code scanning**. For the purpose of this exercise, we will focus on CodeQL analysis.
2424

2525
1. Click on the **Set up** dropdown menu and choose **Default**.
26-
![enable-code-scanning-default.png](/images/enable-code-scanning-default.png)
26+
![enable code scanning](https://github.com/user-attachments/assets/0d639af3-a8fb-4ea7-8b94-44621a34fc3c)
2727

2828
Let's take a look at the configuration options in the modal:
2929

3030
- **Languages to analyze:** These are the languages that will be scanned by CodeQL. In this case, we will be scanning in `Python`.
3131
- **Query suites:** CodeQL [queries](https://docs.github.com/en/code-security/code-scanning/automatically-scanning-your-code-for-vulnerabilities-and-errors/about-code-scanning-with-codeql#about-codeql-queries) are packaged in bundles called "suites". This section allows you to choose which query suite to use. We'll leave this set as **Default** for this exercise. For more information, see "[About CodeQL queries](https://docs.github.com/en/code-security/code-scanning/automatically-scanning-your-code-for-vulnerabilities-and-errors/about-code-scanning-with-codeql#about-codeql-queries)."
3232
- **Events:** This section tells CodeQL when to scan. In this case, it's set to scan on any pull request to the `main` branch.
3333

34-
![codeql-default-configuration-box.png](/images/codeql-default-configuration-box.png)
34+
![codeql default configuration box](https://github.com/user-attachments/assets/cf5ba96b-98bb-4db5-b743-bd31bceaabac)
3535

3636
1. Click **Enable CodeQL**
3737

.github/steps/2-review-and-triage-codeql-alerts.md

Lines changed: 7 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -18,7 +18,7 @@ In this activity, we'll explore GitHub Actions to view the status of a CodeQL sc
1818

1919
1. Select the run by clicking on **CodeQL Setup**.
2020

21-
![codeql-setup](/images/codeql-setup.png)
21+
![codeql setup](https://github.com/user-attachments/assets/016a729e-3b41-466c-8edf-3d4b41a86b7d)
2222

2323
Notice that more information is available inside the Actions run. Feel free to explore this section to view information such as the CodeQL logs, duration, status, and artifacts generated by CodeQL.
2424

@@ -40,26 +40,26 @@ In this activity, we will explore the alert UI. We'll review the data flow of th
4040

4141
**Alert status:** This section displays the current alert status (open or closed), identifies the branch where the scan detected the alert, and shows the timestamp of the alert.
4242

43-
![alert-status](/images/alert-status.png)
43+
![alert status](https://github.com/user-attachments/assets/2fecc67d-52ef-44fc-ad89-1eb28ceb9437)
4444

4545
**Location information:** This section describes which part of the code is vulnerable.
4646

47-
![location-information](/images/location-information.png)
47+
![location information](https://github.com/user-attachments/assets/1a450118-f200-436b-8433-04b7e5e4f1a8)
4848

4949
**Paths:** Clicking on "Show paths" will give you additional insights into the alert's data flow. The modal shows us where the user input (we call that a "source") flows through the application until it's acted on (we call this the "sink"). This visualizes the flow of data through your application.
5050

5151
**Recommendations:** This section provides a quick overview of the tool (CodeQL in this case), Rule ID, and even allows you to view the CodeQL query used to find this vulnerability. You can view the query by clicking **View source**. Additionally, this pane includes recommendations for fixing this vulnerability. Click **Show more** to view the full recommendation.
5252

53-
![recommendations](/images/recommendations.png)
53+
![recommendations](https://github.com/user-attachments/assets/a5653b45-b66f-4e5b-8e03-a7b8cd3b91b4)
5454

5555
**Audit trail:** The audit trail shows the history of the alert. This trail will show the status as users mark an alert as closed or fix an alert in the code.
5656

57-
![audit-trail](/images/audit-trail.png)
57+
![audit trail](https://github.com/user-attachments/assets/25ec5256-20c7-4e9d-8160-ff40f3763872)
5858

5959
**Alert triage:** Use the buttons at the top right of the alert to triage or create a new issue for the alert. Don't do anything yet. We'll get into these buttons in a moment. 😄
6060

6161
**Additional info:** Finally, the right-side panel contains information such as tags, CWE information, and the severity of the alert
62-
![additional-information.png](/images/additiona-information.png)
62+
![additional information](https://github.com/user-attachments/assets/9a5aaf3f-e063-4d07-8cdd-6272eec8a411)
6363

6464
### ⌨️ Activity: Dismiss an Alert
6565

@@ -75,7 +75,7 @@ Now that we're familiar with the alert layout, let's work through the process of
7575

7676
1. Click **1 Closed**. This will bring you to the closed alerts where you can view the alert you just closed.
7777

78-
![one-closed-alert.png](/images/one-closed-alert.png)
78+
![one closed alert](https://github.com/user-attachments/assets/b10005b6-9ef8-4d46-a160-4c9849d2c898)
7979

8080
1. (Optional) You can also reopen the alert by opening it, then selecting **Reopen alert**.
8181

.github/steps/3-fix-security-vulnerabilities.md

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -26,7 +26,7 @@ We now know where the issues exist and how to fix them. We'll start by modifying
2626

2727
1. Click the **Edit** button to the right.
2828

29-
![edit-button.png](/images/edit-button.png)
29+
![edit button](https://github.com/user-attachments/assets/19462cc5-a360-4dae-a97b-ecfd571aa403)
3030

3131
1. Edit line 16 by highlighting the SQL statement and replace it with this text.
3232

.github/steps/4-prevent-vulnerabilities-in-the-pull-request.md

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -27,7 +27,7 @@ In this first activity, we'll introduce the same insecure SQL statement from bef
2727

2828
1. Click the **Edit** button to the right.
2929

30-
![edit-button.png](/images/edit-button.png)
30+
![edit button](https://github.com/user-attachments/assets/19462cc5-a360-4dae-a97b-ecfd571aa403)
3131

3232
1. Edit line 16 by highlighting the SQL statement and replace it with this text.
3333

@@ -51,11 +51,11 @@ Now, let's take a look at the pull request to see what the experience is like.
5151

5252
1. In the previous activity, we created the pull request. After creating the pull request, you were brought directly to the pull request page. At the bottom of the pull request, you will see a check called "Code scanning/CodeQL". This is the CodeQL analysis job scanning the code introduced in the pull request.
5353

54-
![pr-panel](/images/pr-panel.png)
54+
![pr panel](https://github.com/user-attachments/assets/1c29ee0f-cc1d-4568-9e71-338d45ad1d54)
5555

5656
1. Once the check is complete, you will see a new comment in the pull request from CodeQL indicating a new security vulnerability; a SQL query built from user-controlled data. This is our SQL injection vulnerability.
5757

58-
<img width="1180" alt="image" src="https://github.com/leftrightleft/enable-code-scanning/assets/4910518/378bd766-ef61-4619-ab3c-bf2c8d9618d7">
58+
<img width="1180" alt="image" src="https://github.com/user-attachments/assets/677cc104-9116-44a9-8061-091e8126442a">
5959

6060
1. Review the data flow paths by clicking **Show paths**.
6161

images/additiona-information.png

-299 KB
Binary file not shown.

images/alert-status.png

-248 KB
Binary file not shown.

images/audit-trail.png

-219 KB
Binary file not shown.
-140 KB
Binary file not shown.

images/codeql-setup.png

-401 KB
Binary file not shown.

images/edit-button.png

-195 KB
Binary file not shown.
-233 KB
Binary file not shown.

images/location-information.png

-249 KB
Binary file not shown.

images/one-closed-alert.png

-253 KB
Binary file not shown.

images/pr-panel.png

-184 KB
Binary file not shown.

images/recommendations.png

-218 KB
Binary file not shown.
-308 KB
Binary file not shown.

0 commit comments

Comments
 (0)