зеркало из https://github.com/github/docs.git
CodeQL ML-powered JavaScript queries (public beta) (#24363)
This commit is contained in:
Felicity Chapman
GitHub
Родитель
52f0a069a1
Коммит
ee2f75619e
Двоичный файл не отображается.
|
После Ширина: | Высота: | Размер: 40 KiB |
Двоичный файл не отображается.
|
После Ширина: | Высота: | Размер: 215 KiB |
|
|
@ -0,0 +1,119 @@
|
|||
---
|
||||
title: About code scanning alerts
|
||||
intro: 'Learn about the different types of code scanning alerts and the information that helps you understand the problem each alert highlights.'
|
||||
product: '{% data reusables.gated-features.code-scanning %}'
|
||||
versions:
|
||||
fpt: '*'
|
||||
ghes: '*'
|
||||
ghae: '*'
|
||||
ghec: '*'
|
||||
type: overview
|
||||
topics:
|
||||
- Advanced Security
|
||||
- Code scanning
|
||||
- CodeQL
|
||||
---
|
||||
|
||||
{% data reusables.code-scanning.beta %}
|
||||
{% data reusables.code-scanning.enterprise-enable-code-scanning %}
|
||||
|
||||
## About alerts from {% data variables.product.prodname_code_scanning %}
|
||||
|
||||
You can set up {% data variables.product.prodname_code_scanning %} to check the code in a repository using the default {% data variables.product.prodname_codeql %} analysis, a third-party analysis, or multiple types of analysis. When the analysis is complete, the resulting alerts are displayed alongside each other in the security view of the repository. Results from third-party tools or from custom queries may not include all of the properties that you see for alerts detected by {% data variables.product.company_short %}'s default {% data variables.product.prodname_codeql %} analysis. For more information, see "[Setting up {% data variables.product.prodname_code_scanning %} for a repository](/code-security/secure-coding/setting-up-code-scanning-for-a-repository)."
|
||||
|
||||
By default, {% data variables.product.prodname_code_scanning %} analyzes your code periodically on the default branch and during pull requests. For information about managing alerts on a pull request, see "[Triaging {% data variables.product.prodname_code_scanning %} alerts in pull requests](/code-security/secure-coding/triaging-code-scanning-alerts-in-pull-requests)."
|
||||
|
||||
## About alert details
|
||||
|
||||
Each alert highlights a problem with the code and the name of the tool that identified it. You can see the line of code that triggered the alert, as well as properties of the alert, such as the alert severity{% ifversion fpt or ghes > 3.1 or ghae or ghec %}, security severity,{% endif %} and the nature of the problem. Alerts also tell you when the issue was first introduced. For alerts identified by {% data variables.product.prodname_codeql %} analysis, you will also see information on how to fix the problem.
|
||||
|
||||
|
||||
|
||||
If you set up {% data variables.product.prodname_code_scanning %} using {% data variables.product.prodname_codeql %}, you can also find data-flow problems in your code. Data-flow analysis finds potential security issues in code, such as: using data insecurely, passing dangerous arguments to functions, and leaking sensitive information.
|
||||
|
||||
When {% data variables.product.prodname_code_scanning %} reports data-flow alerts, {% data variables.product.prodname_dotcom %} shows you how data moves through the code. {% data variables.product.prodname_code_scanning_capc %} allows you to identify the areas of your code that leak sensitive information, and that could be the entry point for attacks by malicious users.
|
||||
|
||||
### About severity levels
|
||||
|
||||
Alert severity levels may be `Error`, `Warning`, or `Note`.
|
||||
|
||||
If {% data variables.product.prodname_code_scanning %} is enabled as a pull request check, the check will fail if it detects any results with a severity of `error`. {% ifversion fpt or ghes > 3.1 or ghae or ghec %}You can specify which severity level of code scanning alerts causes a check failure. For more information, see "[Defining the severities causing pull request check failure](/code-security/secure-coding/configuring-code-scanning#defining-the-severities-causing-pull-request-check-failure)."{% endif %}
|
||||
|
||||
{% ifversion fpt or ghes > 3.1 or ghae or ghec %}
|
||||
### About security severity levels
|
||||
|
||||
{% data variables.product.prodname_code_scanning_capc %} displays security severity levels for alerts that are generated by security queries. Security severity levels can be `Critical`, `High`, `Medium`, or `Low`.
|
||||
|
||||
To calculate the security severity of an alert, we use Common Vulnerability Scoring System (CVSS) data. CVSS is an open framework for communicating the characteristics and severity of software vulnerabilities, and is commonly used by other security products to score alerts. For more information about how severity levels are calculated, see [this blog post](https://github.blog/changelog/2021-07-19-codeql-code-scanning-new-severity-levels-for-security-alerts/).
|
||||
|
||||
By default, any {% data variables.product.prodname_code_scanning %} results with a security severity of `Critical` or `High` will cause a check failure. You can specify which security severity level for {% data variables.product.prodname_code_scanning %} results should cause a check failure. For more information, see "[Defining the severities causing pull request check failure](/code-security/secure-coding/automatically-scanning-your-code-for-vulnerabilities-and-errors/configuring-code-scanning#defining-the-severities-causing-pull-request-check-failure)."{% endif %}
|
||||
|
||||
### About labels for alerts that are not found in application code
|
||||
|
||||
{% data variables.product.product_name %} assigns a category label to alerts that are not found in application code. The label relates to the location of the alert.
|
||||
|
||||
- **Generated**: Code generated by the build process
|
||||
- **Test**: Test code
|
||||
- **Library**: Library or third-party code
|
||||
- **Documentation**: Documentation
|
||||
|
||||
{% data variables.product.prodname_code_scanning_capc %} categorizes files by file path. You cannot manually categorize source files.
|
||||
|
||||
Here is an example from the {% data variables.product.prodname_code_scanning %} alert list of an alert marked as occurring in library code.
|
||||
|
||||
|
||||
|
||||
On the alert page, you can see that the filepath is marked as library code (`Library` label).
|
||||
|
||||
|
||||
|
||||
{% if codeql-ml-queries %}
|
||||
|
||||
## About experimental alerts
|
||||
|
||||
{% data reusables.code-scanning.beta-codeql-ml-queries %}
|
||||
|
||||
In repositories that run {% data variables.product.prodname_code_scanning %} using the {% data variables.product.prodname_codeql %} action, you may see some alerts that are marked as experimental. These are alerts that were found using a machine learning model to extend the capabilities of an existing {% data variables.product.prodname_codeql %} query.
|
||||
|
||||
|
||||
|
||||
### Benefits of using machine learning models to extend queries
|
||||
|
||||
Queries that use machine learning models are capable of finding vulnerabilities in code that was written using frameworks and libraries that the original query writer did not include.
|
||||
|
||||
Each of the security queries for {% data variables.product.prodname_codeql %} identifies code that's vulnerable to a specific type of attack. Security researchers write the queries and include the most common frameworks and libraries. So each existing query finds vulnerable uses of common frameworks and libraries. However, developers use many different frameworks and libraries, and a manually maintained query cannot include them all. Consequently, manually maintained queries do not provide coverage for all frameworks and libraries.
|
||||
|
||||
{% data variables.product.prodname_codeql %} uses a machine learning model to extend an existing security query to cover a wider range of frameworks and libraries. The machine learning model is trained to detect problems in code it's never seen before. Queries that use the model will find results for frameworks and libraries that are not described in the original query.
|
||||
|
||||
### Alerts identified using machine learning
|
||||
|
||||
Alerts found using a machine learning model are tagged as "Experimental alerts" to show that the technology is under active development. These alerts have a higher rate of false positive results than the queries they are based on. The machine learning model will improve based on user actions such as marking a poor result as a false positive or fixing a good result.
|
||||
|
||||
|
||||
|
||||
## Enabling experimental alerts
|
||||
|
||||
The default {% data variables.product.prodname_codeql %} query suites do not include any queries that use machine learning to generate experimental alerts. To run machine learning queries during {% data variables.product.prodname_code_scanning %} you need to run the additional queries contained in one of the following query suites.
|
||||
|
||||
{% data reusables.code-scanning.codeql-query-suites %}
|
||||
|
||||
When you update your workflow to run an additional query suite this will increase the analysis time.
|
||||
|
||||
``` yaml
|
||||
- uses: github/codeql-action/init@v1
|
||||
with:
|
||||
# Run extended queries including queries using machine learning
|
||||
queries: security-extended
|
||||
```
|
||||
|
||||
For more information, see "[Configuring code scanning](/code-security/code-scanning/automatically-scanning-your-code-for-vulnerabilities-and-errors/configuring-code-scanning#using-queries-in-ql-packs)."
|
||||
|
||||
## Disabling experimental alerts
|
||||
|
||||
The simplest way to disable queries that use machine learning to generate experimental alerts is to stop running the `security-extended` or `security-and-quality` query suite. In the example above, you would comment out the `queries` line. If you need to continue to run the `security-extended` or `security-and-quality` suite and the machine learning queries are causing problems, then you can open a ticket with [{% data variables.product.company_short %} support](https://support.github.com/contact) with the following details.
|
||||
|
||||
- Ticket title: "{% data variables.product.prodname_code_scanning %}: removal from experimental alerts beta"
|
||||
- Specify details of the repositories or organizations that are affected
|
||||
- Request an escalation to engineering
|
||||
|
||||
{% endif %}
|
||||
|
|
@ -43,7 +43,7 @@ There are two main ways to use {% data variables.product.prodname_codeql %} anal
|
|||
|
||||
## About {% data variables.product.prodname_codeql %} queries
|
||||
|
||||
{% data variables.product.company_short %} experts, security researchers, and community contributors write and maintain the default {% data variables.product.prodname_codeql %} queries used for {% data variables.product.prodname_code_scanning %}. The queries are regularly updated to improve analysis and reduce any false positive results. The queries are open source, so you can view and contribute to the queries in the [`github/codeql`](https://github.com/github/codeql) repository. For more information, see [{% data variables.product.prodname_codeql %}](https://securitylab.github.com/tools/codeql) on the GitHub Security Lab website. You can also write your own queries. For more information, see "[About {% data variables.product.prodname_codeql %} queries](https://codeql.github.com/docs/writing-codeql-queries/about-codeql-queries/)" in the {% data variables.product.prodname_codeql %} documentation.
|
||||
{% data variables.product.company_short %} experts, security researchers, and community contributors write and maintain the default {% data variables.product.prodname_codeql %} queries used for {% data variables.product.prodname_code_scanning %}. The queries are regularly updated to improve analysis and reduce any false positive results. The queries are open source, so you can view and contribute to the queries in the [`github/codeql`](https://github.com/github/codeql) repository. For more information, see [{% data variables.product.prodname_codeql %}](https://codeql.github.com/) on the {% data variables.product.prodname_codeql %} website. You can also write your own queries. For more information, see "[About {% data variables.product.prodname_codeql %} queries](https://codeql.github.com/docs/writing-codeql-queries/about-codeql-queries/)" in the {% data variables.product.prodname_codeql %} documentation.
|
||||
|
||||
You can run additional queries as part of your code scanning analysis.
|
||||
|
||||
|
|
|
|||
|
|
@ -17,7 +17,7 @@ topics:
|
|||
- Advanced Security
|
||||
- Code scanning
|
||||
---
|
||||
<!--For this article in earlier GHES versions, see /content/github/finding-security-vulnerabilities-and-errors-in-your-code-->
|
||||
|
||||
|
||||
{% data reusables.code-scanning.beta %}
|
||||
{% data reusables.code-scanning.enterprise-enable-code-scanning %}
|
||||
|
|
|
|||
|
|
@ -24,7 +24,7 @@ topics:
|
|||
- Python
|
||||
shortTitle: Configure code scanning
|
||||
---
|
||||
<!--For this article in earlier GHES versions, see /content/github/finding-security-vulnerabilities-and-errors-in-your-code-->
|
||||
|
||||
|
||||
{% data reusables.code-scanning.beta %}
|
||||
{% data reusables.code-scanning.enterprise-enable-code-scanning-actions %}
|
||||
|
|
@ -89,7 +89,7 @@ If you scan pull requests, then the results appear as alerts in a pull request c
|
|||
{% ifversion fpt or ghes > 3.1 or ghae or ghec %}
|
||||
### Defining the severities causing pull request check failure
|
||||
|
||||
By default, only alerts with the severity level of `Error`{% ifversion fpt or ghes > 3.1 or ghae or ghec %} or security severity level of `Critical` or `High`{% endif %} will cause a pull request check failure, and a check will still succeed with alerts of lower severities. You can change the levels of alert severities{% ifversion fpt or ghes > 3.1 or ghae or ghec %} and of security severities{% endif %} that will cause a pull request check failure in your repository settings. For more information about severity levels, see "[Managing code scanning alerts for your repository](/code-security/secure-coding/automatically-scanning-your-code-for-vulnerabilities-and-errors/managing-code-scanning-alerts-for-your-repository#about-alerts-details)."
|
||||
By default, only alerts with the severity level of `Error`{% ifversion fpt or ghes > 3.1 or ghae or ghec %} or security severity level of `Critical` or `High`{% endif %} will cause a pull request check failure, and a check will still succeed with alerts of lower severities. You can change the levels of alert severities{% ifversion fpt or ghes > 3.1 or ghae or ghec %} and of security severities{% endif %} that will cause a pull request check failure in your repository settings. For more information about severity levels, see "[About code scanning alerts](/code-security/code-scanning/automatically-scanning-your-code-for-vulnerabilities-and-errors/about-code-scanning-alerts#about-alert-details)."
|
||||
|
||||
{% data reusables.repositories.navigate-to-repo %}
|
||||
{% data reusables.repositories.sidebar-settings %}
|
||||
|
|
@ -351,7 +351,7 @@ To add one or more queries, add a `with: queries:` entry within the `uses: githu
|
|||
|
||||
You can also specify query suites in the value of `queries`. Query suites are collections of queries, usually grouped by purpose or language.
|
||||
|
||||
{% data reusables.code-scanning.codeql-query-suites %}
|
||||
{% data reusables.code-scanning.codeql-query-suites-explanation %}
|
||||
|
||||
{% if codeql-packs %}
|
||||
### Working with custom configuration files
|
||||
|
|
|
|||
|
|
@ -26,7 +26,7 @@ topics:
|
|||
- C#
|
||||
- Java
|
||||
---
|
||||
<!--For this article in earlier GHES versions, see /content/github/finding-security-vulnerabilities-and-errors-in-your-code-->
|
||||
|
||||
|
||||
{% data reusables.code-scanning.beta %}
|
||||
{% data reusables.code-scanning.enterprise-enable-code-scanning-actions %}
|
||||
|
|
|
|||
|
|
@ -16,6 +16,7 @@ topics:
|
|||
- Code scanning
|
||||
children:
|
||||
- /about-code-scanning
|
||||
- /about-code-scanning-alerts
|
||||
- /triaging-code-scanning-alerts-in-pull-requests
|
||||
- /setting-up-code-scanning-for-a-repository
|
||||
- /managing-code-scanning-alerts-for-your-repository
|
||||
|
|
@ -28,4 +29,4 @@ children:
|
|||
- /running-codeql-code-scanning-in-a-container
|
||||
- /viewing-code-scanning-logs
|
||||
---
|
||||
<!--For this article in earlier GHES versions, see /content/github/finding-security-vulnerabilities-and-errors-in-your-code-->
|
||||
|
||||
|
|
|
|||
|
|
@ -23,62 +23,9 @@ topics:
|
|||
- Alerts
|
||||
- Repositories
|
||||
---
|
||||
<!--For this article in earlier GHES versions, see /content/github/finding-security-vulnerabilities-and-errors-in-your-code-->
|
||||
|
||||
{% data reusables.code-scanning.beta %}
|
||||
|
||||
## About alerts from {% data variables.product.prodname_code_scanning %}
|
||||
|
||||
You can set up {% data variables.product.prodname_code_scanning %} to check the code in a repository using the default {% data variables.product.prodname_codeql %} analysis, a third-party analysis, or multiple types of analysis. When the analysis is complete, the resulting alerts are displayed alongside each other in the security view of the repository. Results from third-party tools or from custom queries may not include all of the properties that you see for alerts detected by {% data variables.product.company_short %}'s default {% data variables.product.prodname_codeql %} analysis. For more information, see "[Setting up {% data variables.product.prodname_code_scanning %} for a repository](/code-security/secure-coding/setting-up-code-scanning-for-a-repository)."
|
||||
|
||||
By default, {% data variables.product.prodname_code_scanning %} analyzes your code periodically on the default branch and during pull requests. For information about managing alerts on a pull request, see "[Triaging {% data variables.product.prodname_code_scanning %} alerts in pull requests](/code-security/secure-coding/triaging-code-scanning-alerts-in-pull-requests)."
|
||||
|
||||
{% data reusables.code-scanning.upload-sarif-alert-limit %}
|
||||
|
||||
## About alerts details
|
||||
|
||||
Each alert highlights a problem with the code and the name of the tool that identified it. You can see the line of code that triggered the alert, as well as properties of the alert, such as the severity{% ifversion fpt or ghes > 3.1 or ghae or ghec %}, security severity,{% endif %} and the nature of the problem. Alerts also tell you when the issue was first introduced. For alerts identified by {% data variables.product.prodname_codeql %} analysis, you will also see information on how to fix the problem.
|
||||
|
||||
|
||||
|
||||
If you set up {% data variables.product.prodname_code_scanning %} using {% data variables.product.prodname_codeql %}, this can also detect data-flow problems in your code. Data-flow analysis finds potential security issues in code, such as: using data insecurely, passing dangerous arguments to functions, and leaking sensitive information.
|
||||
|
||||
When {% data variables.product.prodname_code_scanning %} reports data-flow alerts, {% data variables.product.prodname_dotcom %} shows you how data moves through the code. {% data variables.product.prodname_code_scanning_capc %} allows you to identify the areas of your code that leak sensitive information, and that could be the entry point for attacks by malicious users.
|
||||
|
||||
### About severity levels
|
||||
|
||||
Alert severity levels may be `Error`, `Warning`, or `Note`.
|
||||
|
||||
By default, any code scanning results with a severity of `error` will cause check failure. {% ifversion fpt or ghes > 3.1 or ghae or ghec %}You can specify the severity level at which pull requests that trigger code scanning alerts should fail. For more information, see "[Defining the severities causing pull request check failure](/code-security/secure-coding/configuring-code-scanning#defining-the-severities-causing-pull-request-check-failure)."{% endif %}
|
||||
|
||||
{% ifversion fpt or ghes > 3.1 or ghae or ghec %}
|
||||
### About security severity levels
|
||||
|
||||
{% data variables.product.prodname_code_scanning_capc %} displays security severity levels for alerts that are generated by security queries. Security severity levels can be `Critical`, `High`, `Medium`, or `Low`.
|
||||
|
||||
To calculate the security severity of an alert, we use Common Vulnerability Scoring System (CVSS) data. CVSS is an open framework for communicating the characteristics and severity of software vulnerabilities, and is commonly used by other security products to score alerts. For more information about how severity levels are calculated, see [the blog post](https://github.blog/changelog/2021-07-19-codeql-code-scanning-new-severity-levels-for-security-alerts/).
|
||||
|
||||
By default, any code scanning results with a security severity of `Critical` or `High` will cause a check failure. You can specify which security severity level for code scanning results should cause a check failure. For more information, see "[Defining the severities causing pull request check failure](/code-security/secure-coding/automatically-scanning-your-code-for-vulnerabilities-and-errors/configuring-code-scanning#defining-the-severities-causing-pull-request-check-failure)."{% endif %}
|
||||
|
||||
### About labels for alerts that are not found in application code
|
||||
|
||||
{% data variables.product.product_name %} assigns a category label to alerts that are not found in application code. The label relates to the location of the alert.
|
||||
|
||||
- **Generated**: Code generated by the build process
|
||||
- **Test**: Test code
|
||||
- **Library**: Library or third-party code
|
||||
- **Documentation**: Documentation
|
||||
|
||||
{% data variables.product.prodname_code_scanning_capc %} categorizes files by file path. You cannot manually categorize source files.
|
||||
|
||||
Here is an example from the {% data variables.product.prodname_code_scanning %} alert list of an alert marked as occuring in library code.
|
||||
|
||||
|
||||
|
||||
On the alert page, you can see that the filepath is marked as library code (`Library` label).
|
||||
|
||||
|
||||
|
||||
## Viewing the alerts for a repository
|
||||
|
||||
Anyone with read permission for a repository can see {% data variables.product.prodname_code_scanning %} annotations on pull requests. For more information, see "[Triaging {% data variables.product.prodname_code_scanning %} alerts in pull requests](/code-security/secure-coding/triaging-code-scanning-alerts-in-pull-requests)."
|
||||
|
|
@ -104,6 +51,8 @@ By default, the code scanning alerts page is filtered to show alerts for the def
|
|||
1. Alerts from {% data variables.product.prodname_codeql %} analysis include a description of the problem. Click **Show more** for guidance on how to fix your code.
|
||||
|
||||
|
||||
For more information, see "[About {% data variables.product.prodname_code_scanning %} alerts](/code-security/code-scanning/automatically-scanning-your-code-for-vulnerabilities-and-errors/about-code-scanning-alerts)."
|
||||
|
||||
{% ifversion fpt or ghes > 3.1 or ghae or ghec %}
|
||||
{% note %}
|
||||
|
||||
|
|
@ -133,7 +82,7 @@ If you enter multiple filters, the view will show alerts matching _all_ these fi
|
|||
|
||||
{% ifversion fpt or ghes > 3.3 or ghec %}
|
||||
|
||||
You can prefix the `tag` filter with `-` to exclude results with that tag. For example, `-tag:style` only shows alerts that do not have the `style` tag.
|
||||
You can prefix the `tag` filter with `-` to exclude results with that tag. For example, `-tag:style` only shows alerts that do not have the `style` tag{% if codeql-ml-queries %} and `-tag:experimental` will omit all experimental alerts. For more information, see "[About {% data variables.product.prodname_code_scanning %} alerts](/code-security/code-scanning/automatically-scanning-your-code-for-vulnerabilities-and-errors/about-code-scanning-alerts#about-experimental-alerts)."{% else %}.{% endif %}
|
||||
|
||||
{% endif %}
|
||||
|
||||
|
|
|
|||
|
|
@ -22,7 +22,7 @@ topics:
|
|||
- Containers
|
||||
- Java
|
||||
---
|
||||
<!--For this article in earlier GHES versions, see /content/github/finding-security-vulnerabilities-and-errors-in-your-code-->
|
||||
|
||||
|
||||
{% data reusables.code-scanning.beta %}
|
||||
{% data reusables.code-scanning.deprecation-codeql-runner %}
|
||||
|
|
|
|||
|
|
@ -21,7 +21,7 @@ topics:
|
|||
- Alerts
|
||||
- Repositories
|
||||
---
|
||||
<!--For this article in earlier GHES versions, see /content/github/finding-security-vulnerabilities-and-errors-in-your-code-->
|
||||
|
||||
|
||||
{% data reusables.code-scanning.beta %}
|
||||
|
||||
|
|
|
|||
|
|
@ -26,7 +26,7 @@ topics:
|
|||
- C#
|
||||
- Java
|
||||
---
|
||||
<!--For this article in earlier GHES versions, see /content/github/finding-security-vulnerabilities-and-errors-in-your-code-->
|
||||
|
||||
|
||||
{% data reusables.code-scanning.beta %}
|
||||
{% data reusables.code-scanning.not-available %}
|
||||
|
|
@ -192,6 +192,19 @@ If you split your analysis into multiple workflows as described above, we still
|
|||
|
||||
If your analysis is still too slow to be run during `push` or `pull_request` events, then you may want to only trigger analysis on the `schedule` event. For more information, see "[Events](/actions/learn-github-actions/introduction-to-github-actions#events)."
|
||||
|
||||
### Check which query suites the workflow runs
|
||||
|
||||
By default, there are three main query suites available for each language. If you have optimized the CodeQL database build and the process is still too long, you could reduce the number of queries you run. The default query suite is run automatically; it contains the fastest security queries with the lowest rates of false positive results.
|
||||
|
||||
You may be running extra queries or query suites in addition to the default queries. Check whether the workflow defines an additional query suite or additional queries to run using the `queries` element. You can experiment with disabling the additional query suite or queries. For more information, see "[Configuring {% data variables.product.prodname_code_scanning %}](/code-security/code-scanning/automatically-scanning-your-code-for-vulnerabilities-and-errors/configuring-code-scanning#using-queries-in-ql-packs)."
|
||||
|
||||
{% if codeql-ml-queries %}
|
||||
{% note %}
|
||||
|
||||
**Note:** If you run the `security-extended` or `security-and-quality` query suite for JavaScript, then some queries use experimental technology. For more information, see "[About code scanning alerts](/code-security/code-scanning/automatically-scanning-your-code-for-vulnerabilities-and-errors/about-code-scanning-alerts#about-experimental-alerts)."
|
||||
{% endnote %}
|
||||
{% endif %}
|
||||
|
||||
{% ifversion fpt or ghec %}
|
||||
## Results differ between analysis platforms
|
||||
|
||||
|
|
|
|||
|
|
@ -21,4 +21,4 @@ children:
|
|||
- /integrating-with-code-scanning
|
||||
- /using-codeql-code-scanning-with-your-existing-ci-system
|
||||
---
|
||||
<!--For this article in earlier GHES versions, see /content/github/finding-security-vulnerabilities-and-errors-in-your-code-->
|
||||
|
||||
|
|
|
|||
|
|
@ -19,7 +19,7 @@ topics:
|
|||
- Webhooks
|
||||
- Integration
|
||||
---
|
||||
<!--For this article in earlier GHES versions, see /content/github/finding-security-vulnerabilities-and-errors-in-your-code-->
|
||||
|
||||
|
||||
{% data reusables.code-scanning.beta %}
|
||||
{% data reusables.code-scanning.enterprise-enable-code-scanning %}
|
||||
|
|
|
|||
|
|
@ -21,4 +21,4 @@ children:
|
|||
- /uploading-a-sarif-file-to-github
|
||||
- /sarif-support-for-code-scanning
|
||||
---
|
||||
<!--For this article in earlier GHES versions, see /content/github/finding-security-vulnerabilities-and-errors-in-your-code-->
|
||||
|
||||
|
|
|
|||
|
|
@ -21,7 +21,7 @@ topics:
|
|||
- Integration
|
||||
- SARIF
|
||||
---
|
||||
<!--For this article in earlier GHES versions, see /content/github/finding-security-vulnerabilities-and-errors-in-your-code-->
|
||||
|
||||
|
||||
{% data reusables.code-scanning.beta %}
|
||||
{% data reusables.code-scanning.deprecation-codeql-runner %}
|
||||
|
|
|
|||
|
|
@ -24,7 +24,7 @@ topics:
|
|||
- CI
|
||||
- SARIF
|
||||
---
|
||||
<!--For this article in earlier GHES versions, see /content/github/finding-security-vulnerabilities-and-errors-in-your-code-->
|
||||
|
||||
|
||||
{% data reusables.code-scanning.beta %}
|
||||
{% data reusables.code-scanning.enterprise-enable-code-scanning %}
|
||||
|
|
|
|||
|
|
@ -28,7 +28,7 @@ topics:
|
|||
- C#
|
||||
- Java
|
||||
---
|
||||
<!--For this article in earlier GHES versions, see /content/github/finding-security-vulnerabilities-and-errors-in-your-code-->
|
||||
|
||||
|
||||
{% data reusables.code-scanning.deprecation-codeql-runner %}
|
||||
{% data reusables.code-scanning.beta %}
|
||||
|
|
@ -83,7 +83,7 @@ $ /path/to-runner/codeql-runner-linux init --languages cpp,java
|
|||
|
||||
{% data reusables.code-scanning.run-additional-queries %}
|
||||
|
||||
{% data reusables.code-scanning.codeql-query-suites %}
|
||||
{% data reusables.code-scanning.codeql-query-suites-explanation %}
|
||||
|
||||
To add one or more queries, pass a comma-separated list of paths to the `--queries` flag of the `init` command. You can also specify additional queries in a configuration file.
|
||||
|
||||
|
|
|
|||
|
|
@ -27,4 +27,4 @@ children:
|
|||
- /troubleshooting-codeql-runner-in-your-ci-system
|
||||
- /migrating-from-the-codeql-runner-to-codeql-cli
|
||||
---
|
||||
<!--For this article in earlier GHES versions, see /content/github/finding-security-vulnerabilities-and-errors-in-your-code-->
|
||||
|
||||
|
|
|
|||
|
|
@ -25,7 +25,7 @@ topics:
|
|||
- CI
|
||||
- SARIF
|
||||
---
|
||||
<!--For this article in earlier GHES versions, see /content/github/finding-security-vulnerabilities-and-errors-in-your-code-->
|
||||
|
||||
<!--UI-LINK: When GitHub Enterprise Server <=3.0 doesn't have GitHub Actions set up, the Security > Code scanning alerts view links to this article.-->
|
||||
|
||||
{% data reusables.code-scanning.deprecation-codeql-runner %}
|
||||
|
|
|
|||
|
|
@ -23,7 +23,7 @@ topics:
|
|||
- Integration
|
||||
- CI
|
||||
---
|
||||
<!--For this article in earlier GHES versions, see /content/github/finding-security-vulnerabilities-and-errors-in-your-code-->
|
||||
|
||||
|
||||
{% data reusables.code-scanning.deprecation-codeql-runner %}
|
||||
{% data reusables.code-scanning.beta %}
|
||||
|
|
|
|||
|
|
@ -30,6 +30,7 @@ includeGuides:
|
|||
- /code-security/secret-scanning/secret-scanning-partners
|
||||
- /code-security/code-scanning/automatically-scanning-your-code-for-vulnerabilities-and-errors/tracking-code-scanning-alerts-in-issues-using-task-lists
|
||||
- /code-security/code-scanning/automatically-scanning-your-code-for-vulnerabilities-and-errors/about-code-scanning
|
||||
- /code-security/code-scanning/automatically-scanning-your-code-for-vulnerabilities-and-errors/about-code-scanning-alerts
|
||||
- /code-security/code-scanning/automatically-scanning-your-code-for-vulnerabilities-and-errors/configuring-code-scanning
|
||||
- /code-security/code-scanning/automatically-scanning-your-code-for-vulnerabilities-and-errors/configuring-the-codeql-workflow-for-compiled-languages
|
||||
- /code-security/code-scanning/automatically-scanning-your-code-for-vulnerabilities-and-errors/managing-code-scanning-alerts-for-your-repository
|
||||
|
|
|
|||
|
|
@ -0,0 +1,6 @@
|
|||
# Reference: #5604.
|
||||
# Documentation for the beta release of CodeQL queries boosted by machine learning
|
||||
# to generate experiemental alerts in code scanning.
|
||||
versions:
|
||||
fpt: '*'
|
||||
ghec: '*'
|
||||
|
|
@ -0,0 +1,9 @@
|
|||
{% if codeql-ml-queries %}
|
||||
|
||||
{% note %}
|
||||
|
||||
**Note:** Experimental alerts for {% data variables.product.prodname_code_scanning %} are created using experimental technology in the {% data variables.product.prodname_codeql %} action. This feature is currently available as a beta release for JavaScript code and is subject to change.
|
||||
|
||||
{% endnote %}
|
||||
|
||||
{% endif %}
|
||||
|
|
@ -0,0 +1,5 @@
|
|||
The following query suites are built into {% data variables.product.prodname_codeql %} {% data variables.product.prodname_code_scanning %} and are available for use.
|
||||
|
||||
{% data reusables.code-scanning.codeql-query-suites %}
|
||||
|
||||
When you specify a query suite, the {% data variables.product.prodname_codeql %} analysis engine will run the default set of queries and any extra queries defined in the additional query suite. {% if codeql-ml-queries %}The `security-extended` and `security-and-quality` query suites for JavaScript contain experimental queries. For more information, see "[About {% data variables.product.prodname_code_scanning %} alerts](/code-security/code-scanning/automatically-scanning-your-code-for-vulnerabilities-and-errors/about-code-scanning-alerts#about-experimental-alerts)."{% endif %}
|
||||
|
|
@ -1,8 +1,4 @@
|
|||
The following query suites are built into {% data variables.product.prodname_codeql %} {% data variables.product.prodname_code_scanning %} and are available for use.
|
||||
|
||||
| Query suite | Description |
|
||||
| :- | :- |
|
||||
| `security-extended` | Queries of lower severity and precision than the default queries |
|
||||
| `security-and-quality` | Queries from `security-extended`, plus maintainability and reliability queries |
|
||||
|
||||
When you specify a query suite, the {% data variables.product.prodname_codeql %} analysis engine will run the queries contained within the suite for you, in addition to the default set of queries.
|
||||
|
|
|
|||
Загрузка…
Ссылка в новой задаче