Skip to content

Instantly share code, notes, and snippets.

@felickz

felickz/ghazdo-codeql-synthetic.md

Last active March 7, 2024 18:03
Show Gist options
  • Save felickz/e862168d3c7ec175779789f97bbf6bde to your computer and use it in GitHub Desktop.
Save felickz/e862168d3c7ec175779789f97bbf6bde to your computer and use it in GitHub Desktop.
Download ZIP
GHAzDO CodeQL custom configuration for security scan of synthetic applications
Raw
ghazdo-codeql-synthetic.md

codeql-synthetics.yml

This file is intended to be used for analyzing synthetic code samples. This configuration uses all possible queries from the CodeQL built in packs along with additional OSS queries and data extensions. It includes more queries than the standard security-experimental suite, providing a more thorough analysis at the cost of longer analysis times and potential false positives. It includes:

  • queries marked as @precision: low or missing a precision
  • queries marked as @problem.severity: recommendation
  • queries in \experimental\ folders
- pwsh: |
      Invoke-WebRequest -Uri "https://raw.githubusercontent.com/GitHubSecurityLab/CodeQL-Community-Packs/main/configs/synthetics.yml" -OutFile "$(Agent.TempDirectory)/synthetics.yml"
    displayName: Copy down CodeQL Config for synthetic applications


  - task: AdvancedSecurity-Codeql-Init@1
    inputs:
      languages: 'java' # your language here
      configfilepath: '$(Agent.TempDirectory)/synthetics.yml'
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment