Resolve CodeQL query alert 57

[roslynwythe]

Prerequisite

1. Be a member of Hack for LA. (There are no fees to join.) If you have not joined yet, please follow the steps on our Getting Started page.
2. Before you claim or start working on an issue, please make sure you have read our How to Contribute to Hack for LA Guide.

Overview

We need to analyze the query "Use of returnless function" which appears in the CodeQL alert 57 then either recommend dismissal of the alert or update code to resolve the alert.

Action Items

• DO NOT DISMISS ANY ALERTS. Dismissal of alerts should be done by dev leads only after review of the recommendation
• Browse to the links in the following two Action Item and read the contents. Click "See More" to view Recommendations, Examples and References.
• https://github.com/hackforla/website/security/code-scanning/57
• In a comment in this issue, add your analysis and recommendations. For each alert, the recommendation can be one of the following: dismiss as test, dismiss as false positive, dismiss as won't fix, or update code.
• If the recommendation is to update code:
  • create an issue branch and proceed with the code update
  • Use docker to test locally, ensuring that there are no changes to any affected webpage(s)
  • proceed with pull request in the usual manner
• If the recommendation is to dismiss, describe your reason for dismissal in the comment, then move the issue to Questions/In Review and apply the label ready for dev lead.

For merge team/dev lead

• If recommendation to dismiss is approved, dismiss the alert with a comment, then close the issue as completed.
• When this issue is closed please check it off (under "Issues") in Create issues to resolve all open CodeQL alerts #5159. If all child issues are closed, close Create issues to resolve all open CodeQL alerts #5159 as completed.

Resources/Instructions

• GitHub CodeQL documentation
• This issue is part of Create Issues for Analysis of CodeQL alerts #5060

[github-actions]

Hi @aqandrew, thank you for taking up this issue! Hfla appreciates you :)

Do let fellow developers know about your:-
i. Availability: (When are you available to work on the issue/answer questions other programmers might have about your issue?)
ii. ETA: (When do you expect this issue to be completed?)

You're awesome!

P.S. - You may not take up another issue until this issue gets merged (or closed). Thanks again :)

[aqandrew]

Availability:

• Wednesday 3/27 10am-3pm
• Thursday 3/28 9am-5pm
• Friday 3/29 9am-5pm

ETA: EOD Friday 3/29

[aqandrew]

Analysis

addEventListener's second parameter is typically a function (MDN). Because the insertEventSchedule function lacks a return statement, calling it inline in right-col-content.js with args in parentheses executes immediately but returns undefined.

Recommendation

update code

Wrap the function call to insertEventSchedule with its arguments in an anonymous function:

  document.addEventListener(
    "DOMContentLoaded",
    () => { insertEventSchedule(eventData, "events"); }
  );

Testing

This update should be tested on every page that imports right-col-content.js:

• right-col-content.js

  • imported in right-col-content.html
    • included in events.html

• Only the events page (/events) needs to be tested.