Skip to content

Commit 1c49cfc

Browse files
GeekMasherGeekMasher
authored
Merge pull request #46 from GitHubSecurityLab/config-synthetics
Add Synthetic CodeQL configuration file
2 parents ffbddb1 + 312d8b8 commit 1c49cfc

File tree

2 files changed

+131
-4
lines changed

2 files changed

+131
-4
lines changed

‎configs/README.md

Lines changed: 17 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -1,13 +1,26 @@
11
# Community Configurations
22

3-
## Default / CodeQL
3+
## [Default / CodeQL](default.yml)
44

5-
The `default.yml` configuration is the default config file used to make it easy to use the CodeQL Community Packs.
5+
The `default.yml` configuration is the default config file used to make it easy to use the CodeQL Community Packs. The queries included here are pulled in from the language `default suites` automatically when referencing the community packs. The default suites as specified in each language's `{LANG}/src/qlpack.yml`. The standard configuration is:
6+
```yml
7+
defaultSuiteFile: suites/{LANG}.qls
8+
```
69
7-
## Audit
10+
## [Audit](audit.yml)
11+
12+
The `audit.yml` configuration is used primarily to conduct a security assessment of potentially vulnerable code, by running a number of audit queries with CodeQL. Many of these queries operate on partial path queries, thus not seeking complete source/sink flows. Use these wide-ranging queries or [partial flow paths](https://codeql.github.com/docs/writing-codeql-queries/debugging-data-flow-queries-using-partial-flow/) as tools to infer potential taint disruptions and identify opportunities for customization improvements.
813

9-
The `audit.yml` configuration is used primary to audit code by running a number of audit queries with CodeQL.
1014
These are based on the suite in each language suites folder called `{LANG}-audit.qls`
1115

1216
> [!NOTE]
1317
> Current Ruby and Swift are not supported
18+
19+
## [Synthetics](synthetics.yml)
20+
21+
This `synthetics.yml` configuration is intended for analyzing synthetic ([intentionally vulnerable](https://owasp.org/www-project-vulnerable-web-applications-directory/)) code samples for vulnerabilities. This configuration uses all possible security queries/extensions from the CodeQL built in packs, the CodeQL Community Packs, and additional OSS packs. It also includes the queries from the built-in `security-experimental.qls` suite with additional lower precision/experimental queries:
22+
- queries marked as `@precision: low` or missing a precision
23+
- queries marked as `@problem.severity: recommendation`
24+
- queries in `\experimental\` folders
25+
26+
This configuration will provide a more thorough analysis at the cost of longer analysis times and potential false positives. Consider using the `audit.yml` configuration to look for additional false negative scenarios.

‎configs/synthetics.yml

Lines changed: 114 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,114 @@
1+
# Use this configuration file when looking to get the broadest coverage of security results from the CodeQL Built in packs and the GitHub Security Lab Community packs.
2+
# WARNING: A notable amount of false positives may be found in this configuration. If you wish to reduce the number of false positives, use the default codeql suites :)
3+
# NOTE: This configuration will not include audit level queries intended for gathering information about the codebase, and debugging queries intended for CodeQL developers.
4+
5+
name: "Synthetic Apps All Queries Config"
6+
7+
# expand thread model - https://docs.github.com/en/code-security/code-scanning/creating-an-advanced-setup-for-code-scanning/customizing-your-advanced-setup-for-code-scanning#extending-codeql-coverage-with-threat-models
8+
threat-models: local
9+
10+
# start from scratch - https://docs.github.com/en/code-security/code-scanning/creating-an-advanced-setup-for-code-scanning/customizing-your-advanced-setup-for-code-scanning#disabling-the-default-queries
11+
disable-default-queries: true
12+
13+
packs:
14+
# All queries from the CodeQL Built in packs (including low/no precision queries)
15+
- codeql/cpp-queries:.
16+
- codeql/csharp-queries:.
17+
- codeql/go-queries:.
18+
- codeql/java-queries:.
19+
- codeql/javascript-queries:.
20+
- codeql/python-queries:.
21+
- codeql/ruby-queries:.
22+
- codeql/swift-queries:.
23+
24+
# OSS queries from the default suites
25+
26+
### GitHub Security Lab###
27+
# Queries via Community Packs https://github.com/GitHubSecurityLab/CodeQL-Community-Packs (NOTE: the default suites do not include audit/debugging queries)
28+
- githubsecuritylab/codeql-cpp-queries
29+
- githubsecuritylab/codeql-csharp-queries
30+
- githubsecuritylab/codeql-go-queries
31+
- githubsecuritylab/codeql-java-queries
32+
- githubsecuritylab/codeql-javascript-queries
33+
- githubsecuritylab/codeql-python-queries
34+
- githubsecuritylab/codeql-ruby-queries
35+
36+
# Queries via Community Packs that use local sources https://github.com/GitHubSecurityLab/CodeQL-Community-Packs
37+
- githubsecuritylab/codeql-java-queries:suites/java-local.qls
38+
- githubsecuritylab/codeql-python-queries:suites/python-local.qls
39+
40+
# Data extensions via Community Packs for libraries (library ext models are those generated by the corresponding queries in src) https://github.com/GitHubSecurityLab/CodeQL-Community-Packs
41+
- githubsecuritylab/codeql-csharp-library-sources
42+
- githubsecuritylab/codeql-java-library-sources
43+
44+
# Data extensions via Community Packs https://github.com/GitHubSecurityLab/CodeQL-Community-Packs
45+
- githubsecuritylab/codeql-csharp-extensions
46+
- githubsecuritylab/codeql-java-extensions
47+
48+
### Trail of Bits ###
49+
# Queris via packs: https://github.com/trailofbits/codeql-queries (default suites include security + crypto
50+
- trailofbits/cpp-queries
51+
- trailofbits/go-queries
52+
53+
# Start with Security Experimental (lightly documented: https://github.com/github/codeql/pull/11702) : https://github.com/github/codeql/blob/main/misc/suite-helpers/security-experimental-selectors.yml
54+
# - precision ( low + Low or EXCLUDED precision)
55+
# + problem.severity: recommendation
56+
# - restriction of no experimental folder
57+
# - restriction of audit/debugging queries from community packs
58+
query-filters:
59+
- include:
60+
kind:
61+
- problem
62+
- path-problem
63+
tags contain:
64+
- security
65+
- include:
66+
kind:
67+
- diagnostic
68+
- include:
69+
kind:
70+
- metric
71+
tags contain:
72+
- summary
73+
- exclude:
74+
deprecated: //
75+
- exclude:
76+
query path:
77+
# REMOVE exclude - OK even if they exist in experimental folder
78+
#- /^experimental\/.*/
79+
- Metrics/Summaries/FrameworkCoverage.ql
80+
- /Diagnostics/Internal/.*/
81+
- exclude:
82+
tags contain:
83+
- modeleditor
84+
- modelgenerator
85+
# Exclude audit queries from the CodeQL Built in packs
86+
- exclude:
87+
id:
88+
- cpp/untrusted-data-to-external-api
89+
- cs/untrusted-data-to-external-api
90+
- go/untrusted-data-to-external-api
91+
- java/untrusted-data-to-external-api
92+
- js/untrusted-data-to-external-api
93+
- py/untrusted-data-to-external-api
94+
95+
# Remove debugging, and audit queries used by community packs (this is duplicative of the default suites from those community packs)
96+
- exclude:
97+
tags contain:
98+
- debugging
99+
- audit
100+
101+
#Additional extractor excludes: https://github.com/github/codeql/blob/768e5190a1c9d40a4acc7143c461c3b114e7fd59/javascript/extractor/src/com/semmle/js/extractor/AutoBuild.java#L421-L427C42
102+
paths-ignore:
103+
# Python
104+
- "vendor/**"
105+
- "examples/**"
106+
- "tests/**"
107+
108+
# JavaScript
109+
- "node_modules"
110+
- "**/*.test.js"
111+
- "**/*.test.tsx"
112+
- "**/*.spec.ts"
113+
- "**/*.spec.tsx"
114+
- "dist"

0 commit comments

Comments
 (0)