Skip to content

Commit 11249e7

Browse files
Apply suggestions from code review - docs tweaks of CUSTOMIZING.md
Co-authored-by: Felicity Chapman <[email protected]>
1 parent c9af53f commit 11249e7

File tree

1 file changed

+4
-4
lines changed

1 file changed

+4
-4
lines changed

javascript/ql/src/Security/CWE-830/CUSTOMIZING.md

Lines changed: 4 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -1,8 +1,8 @@
1-
# Functionaility from untrusted source/domain - customizations
1+
# Extending the library list of untrusted sources and domains
22

3-
You can extend the behavior of the `js/functionality-from-untrusted-source` and `js/functionality-from-untrusted-domain` queries using [CodeQL data extensions](https://codeql.github.com/docs/codeql-language-guides/customizing-library-models-for-javascript/).
3+
You can expand the list of untrusted domains in the CodeQL library used by the `js/functionality-from-untrusted-source` and `js/functionality-from-untrusted-domain` queries using [CodeQL data extensions](https://codeql.github.com/docs/codeql-language-guides/customizing-library-models-for-javascript/).
44

5-
This allows you to require Subresource Integrity (SRI) checks on specific content delivery network (CDN) hostnames, and add additional domains to warn on, respectively.
5+
This allows you to add additional domains to warn users about and to require Subresource Integrity (SRI) checks on specific content delivery network (CDN) hostnames.
66

77
For example, this YAML model can be used inside a CodeQL model pack to alert on uses of `example.com` in imported functionality, extending the `js/functionality-from-untrusted-domain` query:
88

@@ -26,7 +26,7 @@ extensions:
2626
- ["cdn.example.com"]
2727
```
2828

29-
A suitable [model pack](https://docs.github.com/en/code-security/codeql-cli/using-the-advanced-functionality-of-the-codeql-cli/creating-and-working-with-codeql-packs#creating-a-codeql-model-pack) might be:
29+
You would create a model pack with this information using metadata similar to that in the example below:
3030

3131
```yaml
3232
name: my-org/javascript-untrusted-functionality-model-pack

0 commit comments

Comments
 (0)