mirror of
https://github.com/hohn/codeql-lab.git
synced 2025-12-16 01:53:03 +01:00
cleanup: * Modeling Jedis as a Dependency in Model Editor
This commit is contained in:
committed by
=Michael Hohn
parent
85a210f71a
commit
0e06b153cc
@@ -206,49 +206,19 @@
|
||||
- =supported = true= → shows in the UI as /"Method already modeled"/
|
||||
- =supported = false= → shown as /"Unmodeled"/
|
||||
|
||||
** Files Created or Modified by the Modeling Workflow
|
||||
** Files Created or Modified by the Modeling Workflow
|
||||
- Upon launching ==CodeQL: Method modeling==, a new pack manifest is created:
|
||||
: .github/codeql/extensions/jedis-db-local-java/codeql-pack.yml
|
||||
[[../.github/codeql/extensions/jedis-db-local-java/codeql-pack.yml]]
|
||||
- After selecting methods and saving, modeling results are written to:
|
||||
: .github/codeql/extensions/jedis-db-local-java/models/redis.clients.jedis.model.yml
|
||||
- Paths are rooted at =codeql-lab/=
|
||||
|
||||
An example entry for a sink added by the editor:
|
||||
#+BEGIN_SRC yaml
|
||||
extensions:
|
||||
...
|
||||
- addsTo:
|
||||
pack: codeql/java-all
|
||||
extensible: sinkModel
|
||||
data:
|
||||
- ["redis.clients.jedis","Jedis",true,"eval","(String)","","Argument[0]","code-injection","manual"]
|
||||
...
|
||||
#+END_SRC
|
||||
[[../.github/codeql/extensions/jedis-db-local-java/models/redis.clients.jedis.model.yml]]
|
||||
|
||||
** Workspace Configuration Required
|
||||
|
||||
To ensure that these model extensions are applied during query runs, include
|
||||
this setting in the workspace configuration file
|
||||
: .../codeql-lab/qllab.code-workspace
|
||||
|
||||
#+begin_src javascript
|
||||
{
|
||||
"folders": [
|
||||
{ "path": "." }
|
||||
],
|
||||
"settings": {
|
||||
"omnisharp.autoStart": false,
|
||||
"codeQL.githubDatabase.download": "never",
|
||||
"sarif-viewer.connectToGithubCodeScanning": "off",
|
||||
"codeQL.cli.executablePath": "/Users/hohn/work-gh/codeql-lab/codeql/codeql",
|
||||
"codeQL.runningQueries.useExtensionPacks": "all"
|
||||
}
|
||||
}
|
||||
#+end_src
|
||||
this setting in the workspace configuration file [[../qllab.code-workspace]]
|
||||
|
||||
In some environments (e.g., older VS Code versions), you may also need to
|
||||
replicate this setting in:
|
||||
: .../codeql-lab/.vscode/settings.json
|
||||
replicate this setting in [[../.vscode/settings.json]]
|
||||
|
||||
* Verifying the Modeled Sink
|
||||
Once the modeling is in place, a dataflow query like the following can be used
|
||||
@@ -281,7 +251,6 @@
|
||||
| 13 | script | code-injection |
|
||||
| 14 | "return {}" | code-injection |
|
||||
|
||||
|
||||
* Identify usage of injection-related models in existing queries
|
||||
|
||||
To verify whether existing CodeQL queries make use of the injection-related
|
||||
|
||||
Reference in New Issue
Block a user