security: add CodeQL C# static-analysis workflow + WebAuthn ceremony review - #409
Merged
Merged
Conversation
Adds .github/workflows/codeql.yml running CodeQL against the C# code on self-hosted runners (zero GitHub-hosted Actions minutes). Triggers on push/PR to main, a weekly schedule, and workflow_dispatch. Uses manual build-mode (CPM + .slnx makes autobuild unreliable) and wraps the Release build in the EXCLUSIVE box-wide flock, matching fuzz.yml's CPU-heavy discipline. https://claude.ai/code/session_01GSRLZXowGYeRieqaevEtBb
…ngs) Focused security review of the passkey registration + assertion ceremonies (Fido2NetLib 4.0.0-beta.16): challenge lifecycle, origin/RP-id pinning, sign-count clone detection, UV/UP enforcement, credential<->user binding, fail-closed error handling, and log hygiene. Verdict: no clear, exploitable bug — no source changed. All security-critical properties are correctly defended and already pinned by existing tests. Four observations flagged for the owner (UV=Preferred policy knob; username-scoped assert/begin existence-oracle by design; unused GetAllCredentialIds; message-substring clone classification) — all policy/clarity, none a defect. [skip-plan] https://claude.ai/code/session_01GSRLZXowGYeRieqaevEtBb
Ledger entries for the two follow-on security tracks integrated in this PR: the CodeQL static-analysis workflow and the WebAuthn ceremony review (no findings). Per the repo hard rule, the plan is updated in the same PR. https://claude.ai/code/session_01GSRLZXowGYeRieqaevEtBb
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Two follow-on security tracks after the #405 hardening pass, developed in parallel.
1. CodeQL static analysis (C#)
New
.github/workflows/codeql.yml:[self-hosted, Linux, X64]— zero hosted-runner minutes, per the project rule.main, a weekly cron (Mon 03:37 UTC, clear of the 02:17 fuzz nightly), andworkflow_dispatch.build-mode: manual— Central Package Management + the.slnxsolution defeat CodeQL autobuild, so adotnet build Packet.NET.slnx -c Releaseis driven betweeninitandanalyze, wrapped in the exclusiveflock -x /tmp/pdn-ci-heavy.lock(same discipline asfuzz.yml, so it never co-runs with another CPU-heavy workflow on the shared box).analyzestep will fail. The workflow is correct regardless — it just needs that repo setting to surface results.2. WebAuthn / passkey ceremony review — no exploitable findings
Read the registration + assertion path end to end (
PdnWebAuthnApi,WebAuthnFido2Builder,WebAuthnChallengeCache, the credential store). All high-value WebAuthn failure modes are correctly defended — no source change:TryRemove), 5-min TTL off the injected clock, user/session-bound, memory-bounded.Hostcan't widen the trusted origins; IP-literal RP-id rejected.Four non-defect observations recorded for the owner (UV
PreferredvsRequiredpolicy knob; the username-scopedassert/beginis an inherent passkey-existence oracle in the non-discoverable flow; an unused store method; clone-vs-generic log classification keys off an exception substring). Full write-up indocs/webauthn-review-2026-06-13.md.Verification
No source compiled (a workflow file + two docs + the plan ledger). Both tracks were built/tested green during development: Release build clean;
Packet.Node.Tests793 passed / 4 skipped.docs/plan.md§17 updated.https://claude.ai/code/session_01GSRLZXowGYeRieqaevEtBb
Generated by Claude Code