mirror of
https://github.com/Ujwal223/FocusGram.git
synced 2026-11-03 19:58:09 +01:00
41 lines
2.3 KiB
YAML
41 lines
2.3 KiB
YAML
name: "FocusGram CodeQL Configuration"
|
|
|
|
# Exclude queries that break app functionality or report false-positive code smells on WebExtension/content-script assets:
|
|
# 1. java/android/websettings-javascript-enabled: Adsterra rewarded ads require JavaScript to function.
|
|
# 2. java/android/websettings-allow-content-access: Adsterra ad WebViews are isolated; false positives on Jetpack Compose state refs.
|
|
# 3. java/android/missing-certificate-pinning: GitHub API endpoints for updates rotate certificates dynamically; hardcoded pinning breaks update checks.
|
|
# 4. java/android/insecure-local-authentication: Biometric prompt is used as a UI gate, not a cryptographic vault.
|
|
# 5. java/deprecated-call: Deprecated methods are isolated inside explicit Android SDK version branches for backward compatibility.
|
|
# 6. js/incomplete-url-substring-sanitization: Meta / Instagram CDN, auth endpoints, and ghost-mode URLs use complex dynamic domains and subdomains.
|
|
# 7. js/missing-origin-check: Internal postMessage event listeners in WebExtension content scripts and in-page scripts communicate across isolated frame boundaries.
|
|
# 8. js/unused-local-variable: Third-party bundled uBlock Origin and legacy scripts contain unused constants/functions.
|
|
# 9. js/trivial-conditional: Bundled content scripts contain defensive condition guards.
|
|
# 10. js/superfluous-trailing-arguments: Bundled ghost sanitizer utility invocations.
|
|
# 11. js/cross-window-information-leak: WebExtension downloader custom event postMessage communication.
|
|
# 12. js/function-declaration-conflict: Duplicate helper declarations across merged script scopes.
|
|
query-filters:
|
|
- exclude:
|
|
id: java/android/websettings-javascript-enabled
|
|
- exclude:
|
|
id: java/android/websettings-allow-content-access
|
|
- exclude:
|
|
id: java/android/missing-certificate-pinning
|
|
- exclude:
|
|
id: java/android/insecure-local-authentication
|
|
- exclude:
|
|
id: java/deprecated-call
|
|
- exclude:
|
|
id: js/incomplete-url-substring-sanitization
|
|
- exclude:
|
|
id: js/missing-origin-check
|
|
- exclude:
|
|
id: js/unused-local-variable
|
|
- exclude:
|
|
id: js/trivial-conditional
|
|
- exclude:
|
|
id: js/superfluous-trailing-arguments
|
|
- exclude:
|
|
id: js/cross-window-information-leak
|
|
- exclude:
|
|
id: js/function-declaration-conflict
|