Skip to content

Commit 1ecd727

Browse files
committed
Renamed README to CUSTOMIZING, removed details from qhelp and referenced md doc instead
1 parent a07639f commit 1ecd727

File tree

2 files changed

+3
-14
lines changed

2 files changed

+3
-14
lines changed

javascript/ql/src/Security/CWE-693/README.md renamed to javascript/ql/src/Security/CWE-693/CUSTOMIZING.md

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,6 @@
11
# Insecure Helmet Configuration - customizations
22

3-
You can extend the required [Helmet security settings](https://helmetjs.github.io/) using [data extensions](https://codeql.github.com/docs/codeql-language-guides/customizing-library-models-for-javascript/).
3+
You can extend the required [Helmet security settings](https://helmetjs.github.io/) using [data extensions](https://codeql.github.com/docs/codeql-language-guides/customizing-library-models-for-javascript/) in a [CodeQL model pack](https://docs.github.com/en/code-security/codeql-cli/using-the-advanced-functionality-of-the-codeql-cli/creating-and-working-with-codeql-packs#creating-a-codeql-model-pack).
44

55
They are defaulted to just `frameguard` and `contentSecurityPolicy`, but you can add more using this method, to require them not to be set to `false` (which explicitly disables them) in the Helmet configuration.
66

@@ -18,7 +18,7 @@ extensions:
1818
1919
Note: Using `frameguard` and `contentSecurityPolicy` is an example: the query already enforces these, so it is not necessary to add it with your own data extension.
2020

21-
A suitable model pack might be:
21+
A suitable [model pack](https://docs.github.com/en/code-security/codeql-cli/using-the-advanced-functionality-of-the-codeql-cli/creating-and-working-with-codeql-packs#creating-a-codeql-model-pack) might be:
2222

2323
```yaml
2424
name: my-org/javascript-helmet-insecure-config-model-pack

javascript/ql/src/Security/CWE-693/InsecureHelmet.qhelp

Lines changed: 1 addition & 12 deletions
Original file line numberDiff line numberDiff line change
@@ -19,18 +19,7 @@
1919
</p>
2020

2121
<p>
22-
Users of the query can extend the set of required Helmet features by adding additional checks for them, using CodeQL <a href="https://codeql.github.com/docs/codeql-language-guides/customizing-library-models-for-javascript/">data extensions</a>.
23-
</p>
24-
25-
<pre>extensions:
26-
- addsTo:
27-
pack: codeql/javascript-all
28-
extensible: requiredHelmetSecuritySetting
29-
data:
30-
- ["frameguard"]</pre>
31-
32-
<p>
33-
Note: <code>frameguard</code> is an example: the query already enforces this setting, so it is not necessary to add it to the data extension.
22+
Users of the query can extend the set of required Helmet features by adding additional checks for them, using CodeQL <a href="https://codeql.github.com/docs/codeql-language-guides/customizing-library-models-for-javascript/">data extensions</a> in a <a href="https://docs.github.com/en/code-security/codeql-cli/using-the-advanced-functionality-of-the-codeql-cli/creating-and-working-with-codeql-packs#creating-a-codeql-model-pack">CodeQL model pack</a>. See `CUSTOMIZING.md` in the query source for more information.
3423
</p>
3524

3625
</overview>

0 commit comments

Comments
 (0)