Skip to content

Commit 312d8b8

Browse files
authored
Update README.md
1 parent 74d3ae5 commit 312d8b8

File tree

1 file changed

+6
-3
lines changed

1 file changed

+6
-3
lines changed

configs/README.md

Lines changed: 6 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -2,11 +2,14 @@
22

33
## [Default / CodeQL](default.yml)
44

5-
The `default.yml` configuration is the default config file used to make it easy to use the CodeQL Community Packs.
5+
The `default.yml` configuration is the default config file used to make it easy to use the CodeQL Community Packs. The queries included here are pulled in from the language `default suites` automatically when referencing the community packs. The default suites as specified in each language's `{LANG}/src/qlpack.yml`. The standard configuration is:
6+
```yml
7+
defaultSuiteFile: suites/{LANG}.qls
8+
```
69
710
## [Audit](audit.yml)
811
9-
The `audit.yml` configuration is used primary to audit code by running a number of audit queries with CodeQL. Many queries here will be executed using partial path queries - not looking for full source/sink flows. Use these very broad queries or even [partial flow paths](https://codeql.github.com/docs/writing-codeql-queries/debugging-data-flow-queries-using-partial-flow/) to help deduce where the taint might be breaking and to discover areas for potential customization enhancement.
12+
The `audit.yml` configuration is used primarily to conduct a security assessment of potentially vulnerable code, by running a number of audit queries with CodeQL. Many of these queries operate on partial path queries, thus not seeking complete source/sink flows. Use these wide-ranging queries or [partial flow paths](https://codeql.github.com/docs/writing-codeql-queries/debugging-data-flow-queries-using-partial-flow/) as tools to infer potential taint disruptions and identify opportunities for customization improvements.
1013

1114
These are based on the suite in each language suites folder called `{LANG}-audit.qls`
1215

@@ -15,7 +18,7 @@ These are based on the suite in each language suites folder called `{LANG}-audit
1518

1619
## [Synthetics](synthetics.yml)
1720

18-
This `synthetics.yml` configuration is intended for analyzing synthetic ([intentionally vulnerable](https://owasp.org/www-project-vulnerable-web-applications-directory/)) code samples. This configuration uses all possible security queries/extensions from the CodeQL built in packs, the CodeQL Community Packs, and additional OSS packs. It also includes the queries from the built-in `security-experimental.qls` suite with additional lower precision/experimental queries:
21+
This `synthetics.yml` configuration is intended for analyzing synthetic ([intentionally vulnerable](https://owasp.org/www-project-vulnerable-web-applications-directory/)) code samples for vulnerabilities. This configuration uses all possible security queries/extensions from the CodeQL built in packs, the CodeQL Community Packs, and additional OSS packs. It also includes the queries from the built-in `security-experimental.qls` suite with additional lower precision/experimental queries:
1922
- queries marked as `@precision: low` or missing a precision
2023
- queries marked as `@problem.severity: recommendation`
2124
- queries in `\experimental\` folders

0 commit comments

Comments
 (0)