You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Copy file name to clipboardExpand all lines: docs/codeql/codeql-for-visual-studio-code/using-the-codeql-model-editor.rst
+7-20Lines changed: 7 additions & 20 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -13,6 +13,10 @@ TODO - EDIT THIS CONTENT!
13
13
14
14
Explain how to find the data extension files that you've created and test them. Also how to save to the right location in a GitHub repository for default and advanced setup to use.
15
15
16
+
Copy file into GitHub folder
17
+
18
+
For testing: "codeQL.runningQueries.useModelPacks": true, - does it work for MRVA
19
+
16
20
About the CodeQL model editor
17
21
-----------------------------
18
22
@@ -23,26 +27,6 @@ The editor takes a CodeQL database and runs some telemetry queries to identify u
23
27
- Application mode: the editor identifies the external APIs used by the codebase. An external (or third party) API is any API that is not part of the CodeQL database you are analyzing. This mode is most useful for improving CodeQL results for the specific codebase.
24
28
- Framework mode: the editor identifies the publicly accessible APIs in the codebase. This mode is most useful for improving the CodeQL results for any codebases that use those APIs.
25
29
26
-
Setting up the CodeQL model editor
27
-
----------------------------------
28
-
29
-
To set up the CodeQL model editor, you need to be using CodeQL for VS Code 1.8.12 or later with the following settings:
30
-
31
-
.. code-block:: json
32
-
33
-
{
34
-
"codeQL.canary": true,
35
-
"codeQL.model.editor": true,
36
-
"codeQL.runningQueries.useModelPacks": true,
37
-
}
38
-
39
-
CHECK THIS ^^^ - is canary still needed?
40
-
41
-
Open the user settings editor (JSON) using the command palette (Ctrl/Cmd+Shift+P) and using the command “Preferences: Open User Settings (JSON)”, add these two settings to the file.
42
-
43
-
If you want to test the CodeQL model packs you generate in VS Code then this setting is also required:
44
-
``"codeQL.runningQueries.useExtensionPacks": true`` CHECK THIS - should it be ``"codeQL.runningQueries.useModelPacks": true``
45
-
46
30
Using the CodeQL model editor
47
31
-----------------------------
48
32
@@ -55,13 +39,16 @@ The easiest way to explain this is by using an example, so we'll run through an
55
39
#. When the queries are complete, the APIs that have been identified are shown in the editor:
56
40
- By default the editor runs in application mode, so displays the external APIs used by the codebase.
57
41
- If you switch to framework mode, the editor will display the publicly accessible APIs in the codebase.
42
+
58
43
#. You can now start modeling the external API calls manually by selecting a model type and entering the correct values in each field, as defined in the Java models-as-data documentation
59
44
#. You can generate the CodeQL automatically:
60
45
- If you are working in application mode click on “Model from source” and enter the name of the repo that contains the source code for the package you want to model. For example, in this case you can enter dsp-testing/sql2o-import to download the relevant CodeQL database and model any APIs from that repo
61
46
- If you are working in framework mode click on “Generate” to generate any models directly from the source code of the framework you are modeling.
47
+
62
48
#. Once any modeling is complete, click “Save” or “Save all”. You can now see that the calls are shown as supported. The generated models files are saved in your workspace at .github/codeql/extensions/<pack-name>, where the pack name is the same as the repo.
63
49
- If you are in application mode, the editor will create a separate model file for each package that you model.
64
50
- If you are in framework mode, the edit will generate a single model file for the entire framework.
51
+
65
52
#. If you have set up VS Code to use data extensions (using the “codeQL.runningQueries.useExtensionPacks” setting), then you can also run a query and see that the unsafe calls are now detected.
0 commit comments