From e674f44dd25fac6f3cc4dba7661190da93447281 Mon Sep 17 00:00:00 2001 From: Nick Rolfe Date: Mon, 9 Nov 2026 14:32:41 +0000 Subject: [PATCH] Shared: convert data extensions to JSON --- .../ext/supported-threat-models.model.json | 13 ++++++ .../ext/supported-threat-models.model.yml | 6 --- .../ext/threat-model-grouping.model.json | 41 +++++++++++++++++++ .../ext/threat-model-grouping.model.yml | 34 --------------- shared/threat-models/qlpack.yml | 1 + shared/util/ext/default-alert-filter.json | 20 +++++++++ shared/util/ext/default-alert-filter.yml | 13 ------ shared/util/qlpack.yml | 1 + 8 files changed, 76 insertions(+), 53 deletions(-) create mode 100644 shared/threat-models/ext/supported-threat-models.model.json delete mode 100644 shared/threat-models/ext/supported-threat-models.model.yml create mode 100644 shared/threat-models/ext/threat-model-grouping.model.json delete mode 100644 shared/threat-models/ext/threat-model-grouping.model.yml create mode 100644 shared/util/ext/default-alert-filter.json delete mode 100644 shared/util/ext/default-alert-filter.yml diff --git a/shared/threat-models/ext/supported-threat-models.model.json b/shared/threat-models/ext/supported-threat-models.model.json new file mode 100644 index 000000000000..d4162bde1250 --- /dev/null +++ b/shared/threat-models/ext/supported-threat-models.model.json @@ -0,0 +1,13 @@ +{ + "extensions": [ + { + "addsTo": { + "pack": "codeql/threat-models", + "extensible": "threatModelConfiguration" + }, + "data": [ + ["default", true, -2147483648] // The "default" threat model is included by default + ] + } + ] +} diff --git a/shared/threat-models/ext/supported-threat-models.model.yml b/shared/threat-models/ext/supported-threat-models.model.yml deleted file mode 100644 index 59589f50f386..000000000000 --- a/shared/threat-models/ext/supported-threat-models.model.yml +++ /dev/null @@ -1,6 +0,0 @@ -extensions: - - addsTo: - pack: codeql/threat-models - extensible: threatModelConfiguration - data: - - ["default", true, -2147483648] # The "default" threat model is included by default diff --git a/shared/threat-models/ext/threat-model-grouping.model.json b/shared/threat-models/ext/threat-model-grouping.model.json new file mode 100644 index 000000000000..cc33d4ed0d09 --- /dev/null +++ b/shared/threat-models/ext/threat-model-grouping.model.json @@ -0,0 +1,41 @@ +{ + "extensions": [ + { + "addsTo": { + "pack": "codeql/threat-models", + "extensible": "threatModelGrouping" + }, + "data": [ + // Default threat model + ["remote", "default"], + + // Remote threat models + ["request", "remote"], + ["response", "remote"], + + // Local threat models + ["database", "local"], + ["commandargs", "local"], + ["environment", "local"], + ["stdin", "local"], + ["file", "local"], + ["windows-registry", "local"], + + // Android threat models + ["android-external-storage-dir", "android"], + ["contentprovider", "android"], + + // Threat models that are not grouped with any other threat models. + // (Note that all threat models are a child of "all" implicitly, and we + // make it explicit here just to make sure all threat models are listed.) + ["database-access-result", "all"], + ["file-write", "all"], + ["reverse-dns", "all"], + ["view-component-input", "all"], + + // AI threat models + ["ai", "all"] + ] + } + ] +} diff --git a/shared/threat-models/ext/threat-model-grouping.model.yml b/shared/threat-models/ext/threat-model-grouping.model.yml deleted file mode 100644 index 414cbda6fabe..000000000000 --- a/shared/threat-models/ext/threat-model-grouping.model.yml +++ /dev/null @@ -1,34 +0,0 @@ -extensions: - - - addsTo: - pack: codeql/threat-models - extensible: threatModelGrouping - data: - # Default threat model - - ["remote", "default"] - - # Remote threat models - - ["request", "remote"] - - ["response", "remote"] - - # Local threat models - - ["database", "local"] - - ["commandargs", "local"] - - ["environment", "local"] - - ["stdin", "local"] - - ["file", "local"] - - ["windows-registry", "local"] - - # Android threat models - - ["android-external-storage-dir", "android"] - - ["contentprovider", "android"] - - # Threat models that are not grouped with any other threat models. - # (Note that all threat models are a child of "all" implicitly, and we - # make it explicit here just to make sure all threat models are listed.) - - ["database-access-result", "all"] - - ["file-write", "all"] - - ["reverse-dns", "all"] - - ["view-component-input", "all"] - # AI threat models - - ["ai", "all"] diff --git a/shared/threat-models/qlpack.yml b/shared/threat-models/qlpack.yml index 23ea2cf9c981..c20e02c1f82f 100644 --- a/shared/threat-models/qlpack.yml +++ b/shared/threat-models/qlpack.yml @@ -4,4 +4,5 @@ library: true groups: shared dataExtensions: - ext/*.model.yml + - ext/*.model.json warnOnImplicitThis: true diff --git a/shared/util/ext/default-alert-filter.json b/shared/util/ext/default-alert-filter.json new file mode 100644 index 000000000000..a204b5a5a4df --- /dev/null +++ b/shared/util/ext/default-alert-filter.json @@ -0,0 +1,20 @@ +{ + "extensions": [ + { + "addsTo": { + "pack": "codeql/util", + "extensible": "restrictAlertsTo" + }, + // Empty predicate means no restrictions on alert locations + "data": [] + }, + { + "addsTo": { + "pack": "codeql/util", + "extensible": "restrictAlertsToExactLocation" + }, + // Empty predicate means no restrictions on alert locations + "data": [] + } + ] +} diff --git a/shared/util/ext/default-alert-filter.yml b/shared/util/ext/default-alert-filter.yml deleted file mode 100644 index 1c4dd263d055..000000000000 --- a/shared/util/ext/default-alert-filter.yml +++ /dev/null @@ -1,13 +0,0 @@ -extensions: - - - addsTo: - pack: codeql/util - extensible: restrictAlertsTo - # Empty predicate means no restrictions on alert locations - data: [] - - - addsTo: - pack: codeql/util - extensible: restrictAlertsToExactLocation - # Empty predicate means no restrictions on alert locations - data: [] diff --git a/shared/util/qlpack.yml b/shared/util/qlpack.yml index 8e1207a4eea1..ccb1887d91cf 100644 --- a/shared/util/qlpack.yml +++ b/shared/util/qlpack.yml @@ -5,4 +5,5 @@ library: true dependencies: null dataExtensions: - ext/*.yml + - ext/*.json warnOnImplicitThis: true