Code scanning alerts found in minified code from webpack

[dastrobu]

After heaving set up CodeQL scanning it found some issue in the generated JavaScript files in the dist folder.
The file is generated by webpack and, hence, not kept in the repo.
That is why we cannot see where the issue is coming from:

Even if we had the file in the repository, it would be challenging to understand the problems in the minified JavaScript code. Additionally, it would be difficult to determine how to modify the original sources to address these issues.

My question is, how to handle these cases efficiently?
I could of course add the dist folder to paths-ignore. However, I am hesitant to ignore the code that is actually executed in the end and only scan the code that is used as input for webpack.

[mariusp12]

We also have the same problem: what should we do with the issues in the generated JS of an Angular application.

[aeisenberg]

Our recommendation is to add dist to paths-ignore. The dist folder contains minified versions of your own code, which is already checked by codeql. It also contains library code, which is checked by dependabot. So, everything in the folder should already be covered.

[mbg]

@justinmchase Could you clarify what you are asking about? If your question is about how to add dist to paths-ignore, the documentation that was linked to in the original question should answer that.

[justinmchase]

Sorry, I don't have a codeql workflow, Im using the built in codeql tool and I'm wondering if there is a way to configure this without having to replace it with an entirely custom workflow.

[mbg]

Assuming that you are using default setup, then I don't believe you can customise it in this way. You would have to migrate to an advanced (custom) workflow.

[justinmchase]

Ok, thanks, I was coming to that conclusion as well. Our enterprise is managing the default settings and rules so I think I'm stuck.

Consider this a feature request to have exclusions in the default setup configuration.

[mbg]

Thanks for confirming @justinmchase -- it makes sense and we have noted the feature request.