@@ -0,0 +1,89 @@
1+name: openclaw-codeql-plugin-trust-boundary-critical-security
2+3+disable-default-queries: true
4+5+queries:
6+ - uses: security-extended
7+8+query-filters:
9+ - include:
10+precision:
11+ - high
12+ - very-high
13+ - exclude:
14+problem.severity:
15+ - recommendation
16+ - warning
17+18+paths:
19+ - src/cli/plugin-install-config-policy.ts
20+ - src/cli/plugin-registry-loader.ts
21+ - src/cli/plugins-command-helpers.ts
22+ - src/cli/plugins-install-command.ts
23+ - src/cli/plugins-install-record-commit.ts
24+ - src/plugins/activation-planner.ts
25+ - src/plugins/bundle-manifest.ts
26+ - src/plugins/bundled-compat.ts
27+ - src/plugins/bundled-dir.ts
28+ - src/plugins/bundled-plugin-metadata.ts
29+ - src/plugins/bundled-plugin-scan.ts
30+ - src/plugins/bundled-runtime-deps*.ts
31+ - src/plugins/bundled-runtime-root.ts
32+ - src/plugins/cli-registry-loader.ts
33+ - src/plugins/config-activation-shared.ts
34+ - src/plugins/config-contracts.ts
35+ - src/plugins/config-policy.ts
36+ - src/plugins/config-schema.ts
37+ - src/plugins/dependency-denylist.ts
38+ - src/plugins/discovery.ts
39+ - src/plugins/effective-plugin-ids.ts
40+ - src/plugins/externalized-bundled-plugins.ts
41+ - src/plugins/install.runtime.ts
42+ - src/plugins/install-source-info.ts
43+ - src/plugins/installed-plugin-index*.ts
44+ - src/plugins/loader*.ts
45+ - src/plugins/manifest*.ts
46+ - src/plugins/marketplace.ts
47+ - src/plugins/module-export.ts
48+ - src/plugins/package-entrypoints.ts
49+ - src/plugins/plugin-config-trust.ts
50+ - src/plugins/plugin-origin.types.ts
51+ - src/plugins/plugin-registry*.ts
52+ - src/plugins/public-surface*.ts
53+ - src/plugins/registry*.ts
54+ - src/plugins/runtime
55+ - src/plugins/runtime-state.ts
56+ - src/plugins/runtime.ts
57+ - src/plugins/source-loader.ts
58+ - src/plugins/update.ts
59+ - src/plugins/validation-diagnostics.ts
60+ - src/plugin-sdk/*entry*.ts
61+ - src/plugin-sdk/*facade*.ts
62+ - src/plugin-sdk/api-baseline.ts
63+ - src/plugin-sdk/config-schema.ts
64+ - src/plugin-sdk/config-types.ts
65+ - src/plugin-sdk/core.ts
66+ - src/plugin-sdk/extension-shared.ts
67+ - packages/plugin-package-contract/src
68+ - packages/plugin-sdk/src/plugin-entry.ts
69+ - packages/plugin-sdk/src/plugin-runtime.ts
70+ - packages/plugin-sdk/src/runtime-env.ts
71+ - packages/plugin-sdk/src/security-runtime.ts
72+73+paths-ignore:
74+ - "**/node_modules"
75+ - "**/coverage"
76+ - "**/*.generated.ts"
77+ - "**/*.bundle.js"
78+ - "**/*-runtime.js"
79+ - "**/*.test.ts"
80+ - "**/*.test.tsx"
81+ - "**/*.spec.ts"
82+ - "**/*.spec.tsx"
83+ - "**/*.e2e.test.ts"
84+ - "**/*.e2e.test.tsx"
85+ - "**/*test-support*"
86+ - "**/*test-helper*"
87+ - "**/*mock*"
88+ - "**/*fixture*"
89+ - "**/*bench*"
此内容由惯性聚合(RSS阅读器)自动聚合整理，仅供阅读参考。 原文来自 — 版权归原作者所有。