Triage the 47 remaining CodeQL alerts from the 2026-06-13 backlog

[plavjanik]

All open CodeQL alerts in this repository share a single creation timestamp, 2026-06-13T14:10:17Z — the moment CodeQL was first enabled during the CI hardening work. None have been triaged since. There are 50 open CodeQL alerts (plus 26 ESLint alerts, tracked separately).

Three of them, all in scripts/sdk-switch.js, are fixed in #106 because that PR already rewrites the affected function. This issue tracks the remaining 47.

Worth knowing before triaging: a large share sit in code that is not the shipped attack surface — the mock z/OS host is a deliberate test double, and zowe-mcp-evals plus scripts/ are developer tooling. Several are likely to be dismissals ("used in tests", "not exploitable") rather than code changes. The ones that deserve real scrutiny are those in the actual server transport and the VS Code extension.

By rule

Severity	Count	Rule
high	10	js/missing-rate-limiting
high	5	js/file-system-race
high	3	js/incomplete-sanitization
high	3	js/user-controlled-bypass
high	2	js/biased-cryptographic-random
high	2	js/clear-text-logging
high	2	js/regex-injection
high	2	js/remote-property-injection
high	1	js/insecure-temporary-file
high	1	js/insufficient-password-hash
high	1	js/polynomial-redos
medium	12	js/file-access-to-http
medium	1	js/http-to-file-access
medium	1	js/indirect-command-line-injection
medium	1	js/log-injection

By area

Count	Area
23	packages/zowe-mcp-server
10	packages/zowe-mcp-evals
4	scripts/rephrase-tool-descriptions.mjs
4	scripts/download-zosmf-specs.mjs
3	packages/zowe-mcp-vscode
2	scripts/bundle-production-deps.cjs
1	scripts/set-version.js

Highest-value subset

These are in shipped code rather than tooling or test doubles, so they should be looked at first:

• Bump github/codeql-action from 4.37.3 to 4.37.5 #51 js/remote-property-injection — packages/zowe-mcp-vscode/src/event-handler.ts:470
• keyring support #50 js/remote-property-injection — packages/zowe-mcp-vscode/src/event-handler.ts:452
• Add System Tools for Proclib, Syslog, LinkList, and APF Data Sets #45 js/user-controlled-bypass — packages/zowe-mcp-server/src/transports/http.ts:252
• feat(native): SSH key authentication with password fallback #44 js/user-controlled-bypass — packages/zowe-mcp-server/src/transports/http.ts:245
• Add MCP server card command and .well-known HTTP endpoint #43 js/user-controlled-bypass — packages/zowe-mcp-server/src/mock-host/zosmf/routes/authenticate.ts:152
• chore(deps): clear js-yaml + markdown-it moderate advisories #25 js/file-system-race — packages/zowe-mcp-server/src/scripts/generate-docs.ts:1173
• ci: ci-ok aggregate gate + advisory changelog check (Phase 6) #22 js/biased-cryptographic-random — packages/zowe-mcp-server/src/zos/temp-dsn.ts:54
• ci: cross-platform matrix — Windows + macOS (Phase 5) #21 js/biased-cryptographic-random — packages/zowe-mcp-server/src/zos/temp-dsn.ts:52
• ci: add CodeQL SAST (Phase 4, PR 2/2) #18 js/regex-injection — packages/zowe-mcp-server/src/zos/mock/filesystem-mock-backend.ts:172
• ci: add npm audit gate + Dependabot (Phase 4, PR 1/2) #17 js/regex-injection — packages/zowe-mcp-server/src/mock-host/zosmf/routes/restfiles-ds-read.ts:245
• docs: port harness-agnostic intro + getContext rename to develop #16 js/insufficient-password-hash — packages/zowe-mcp-vscode/src/event-handler.ts:206
• ci: make generate-docs deterministic and gate docs drift #14 js/missing-rate-limiting — packages/zowe-mcp-server/src/transports/http.ts:332
• ci: harden build job + enforce format and duplication gates (Phase 1 + 2) #13 js/missing-rate-limiting — packages/zowe-mcp-server/src/transports/http.ts:315
• chore: address CI carry-overs (format, actions, typecheck consolidation, test-hang note) #12 js/missing-rate-limiting — packages/zowe-mcp-server/src/transports/http.ts:237
• Rewrite README.md #11 js/missing-rate-limiting — packages/zowe-mcp-server/src/mock-host/zosmf/routes/restfiles-ds-read.ts:94
• Consider cleaning up docs/ #10 js/missing-rate-limiting — packages/zowe-mcp-server/src/mock-host/zosmf/routes/restfiles-ds-read.ts:91
• test: eliminate all test type errors and enforce test type-checking in CI #9 js/missing-rate-limiting — packages/zowe-mcp-server/src/mock-host/zosmf/routes/restfiles-ds-read.ts:88
• ci: enable markdownlint and clear the backlog #8 js/missing-rate-limiting — packages/zowe-mcp-server/src/mock-host/zosmf/routes/restfiles-ds.ts:52
• chore: add CODEOWNERS for branch protection #7 js/missing-rate-limiting — packages/zowe-mcp-server/src/mock-host/zosmf/routes/authenticate.ts:72
• ci: phase 0 — npm ci, typecheck script, jscpd cleanup #6 js/missing-rate-limiting — packages/zowe-mcp-server/src/mock-host/zosmf/routes/authenticate.ts:68
• feat: Progressive capability tiers for AI safety and access control #5 js/missing-rate-limiting — packages/zowe-mcp-server/src/mock-host/zosmf/routes/info.ts:41
• CLI plugin bridge, HTTP OAuth/JWT, credentials & jobs, evals tooling, and docs (develop → main) #4 js/incomplete-sanitization — packages/zowe-mcp-server/src/scripts/generate-docs.ts:258
• Meeting Notes 17-3-2026 #3 js/incomplete-sanitization — packages/zowe-mcp-server/src/scripts/generate-docs.ts:185
• Initial contribution: Zowe MCP server and VS Code extension #1 js/polynomial-redos — packages/zowe-mcp-server/src/mock-host/zosmf/middleware/auth.ts:33

Suggested approach

1. Triage each alert as real / false positive / accepted risk, starting with the subset above.
2. Fix the real ones in small, reviewable PRs grouped by rule.
3. Dismiss the rest through the Security tab with a written reason, so the count reaches zero and future alerts are visible rather than lost in the backlog.

A standing backlog this size means a genuinely new finding is easy to miss — getting to zero is most of the value here.