Allow to specify the relevant threat model when running a query

Open
#4,027 3 comments 1 reaction 0 assignees View on GitHub

Nobody has claimed this yet.

Assessment

Difficulty
5/5
Estimated time
Over a week
Newbie friendliness
25/100
Issue type
Feature
Clarity
Needs clarification
Activity status
Stale
Tech stack
typescript, vscode
Domain
devtools, security

Research direction

Start by reviewing the CodeQL: Run Query on Selected Database command and how the CLI's --threat-model option is exposed to query execution. Done means the extension provides a decided way to select or configure the relevant threat model and displays the resulting query findings directly in the IDE.

Written by the indexing model from the issue text.

Description

enhancement VSCode

Is your feature request related to a problem? Please describe.
The codeql CLI interface offers the option to specify a threat model by e.g. using the --threat-model local flag.
However, as far as I'm aware, there is not such feature in the IDE itself to configure the threat model.

Describe the solution you'd like
Either:

  • add a dropdown when running a query using CodeQL: Run Query on Selected Database where the user has to select the threat model every time they run a query
  • add a global config option to the plugin (could be problematic when different languages potentially support different threat models)
  • add a new CodeQL: Run Query on Selected Database with Thread Model option.
  • add a "Set Threat Model" for database command.

Describe alternatives you've considered
Run the query on the db using codeql database analyze yada yada yada --threat-model local.
However, looking at the result in SARIF isn't as nice as looking at the result of the CodeQL extension directly in the IDE.

Dominant language
TypeScript
Stars
539
Forks
240
Avg merge
2d 6h
Merged PRs (30d)
29

Contributor guide

Open the contributing guide

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

More from github/vscode-codeql

All issues in github/vscode-codeql

Similar issues

More TypeScript issues

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.