mirror of
https://github.com/heygen-com/hyperframes.git
synced 2026-09-14 18:01:20 +08:00
ukimsanov
72 lines
3.3 KiB
YAML
72 lines
3.3 KiB
YAML
name: "Hyperframes CodeQL config"
|
|
|
|
# Use GitHub's default security-extended suite — it's a strict superset of the
|
|
# default suite (more queries, slightly higher false-positive rate). Pair it with
|
|
# the query-filters below so the extra queries don't drown the dashboard.
|
|
queries:
|
|
- uses: security-extended
|
|
|
|
# The docs Reference Project's live embed is a generated publish artifact. It
|
|
# inlines the same HyperFrames runtime that CodeQL already analyzes at source,
|
|
# so scanning the compiled copy reports runtime bridge and URL-normalization
|
|
# patterns as new code. Exclude only this immutable generated file.
|
|
paths-ignore:
|
|
- "examples/docs-reference-project/live/index.html"
|
|
|
|
# Per-rule path filters. The intent is to silence rules that have known false
|
|
# positives on specific file shapes (generated test artifacts, CDN-script test
|
|
# fixtures, functional-cleanup regex) WITHOUT excluding those paths from all
|
|
# analysis — a malicious contributor adding e.g. a command-injection sink into
|
|
# a "test fixture" would still get caught.
|
|
#
|
|
# To audit what changed: look at PR diffs touching this file. Reviewers should
|
|
# treat it like CODEOWNERS — adding a new path exclusion is a policy change.
|
|
query-filters:
|
|
# Generated test artifacts (golden baselines written by the producer test
|
|
# harness). Every compiled.html re-rasterizes the regex-stripped composition;
|
|
# the same alerts fire on every fixture and on every re-render.
|
|
- exclude:
|
|
id: js/incomplete-sanitization
|
|
paths:
|
|
- "packages/producer/tests/**/output/compiled.html"
|
|
- "packages/producer/tests/**/failures/*.html"
|
|
|
|
# Test fixtures and skill test corpora intentionally load CDN scripts without
|
|
# SRI — pinning hashes there would fight the test's purpose (we want the test
|
|
# to use whatever the registry hands back, the same way a composition would).
|
|
- exclude:
|
|
id: js/functionality-from-untrusted-source
|
|
paths:
|
|
- "packages/producer/tests/**"
|
|
- "skills/**/test-corpus/**"
|
|
- "skills/**/assets/test-corpus/**"
|
|
|
|
# The hand-rolled HTML cleanup regex in our build-time tooling looks like a
|
|
# sanitizer to CodeQL but isn't one — it strips framework bootstraps from
|
|
# captured pages before they're fed back into our own renderer (Puppeteer,
|
|
# not a user-facing DOM). Same for the text normalizer in the whisper path
|
|
# (caption text → SRT/VTT, no DOM emission). Scope these exclusions to the
|
|
# exact files that contain functional regex, not to whole directories, so
|
|
# any new code in cli/, core/, or producer/ that LOOKS like a sanitizer
|
|
# still trips the rules.
|
|
- exclude:
|
|
id: js/bad-tag-filter
|
|
paths:
|
|
- "packages/cli/src/capture/index.ts"
|
|
- "packages/cli/src/whisper/normalize.ts"
|
|
- "packages/core/src/lint/utils.ts"
|
|
- "packages/producer/src/services/htmlCompiler.ts"
|
|
- exclude:
|
|
id: js/incomplete-multi-character-sanitization
|
|
paths:
|
|
- "packages/cli/src/capture/index.ts"
|
|
- "packages/cli/src/whisper/normalize.ts"
|
|
|
|
# Golden baselines inline vendor libraries (Three.js, GSAP) whose bundled
|
|
# Math.random() calls trip insecure-randomness. These are test artifacts
|
|
# from compiled compositions, not production code paths.
|
|
- exclude:
|
|
id: js/insecure-randomness
|
|
paths:
|
|
- "packages/producer/tests/**/output/compiled.html"
|