mirror of
https://github.com/openclaw/openclaw.git
synced 2026-05-02 22:46:44 +02:00
2bce63cb65
* fix(android): harden canvas webview bridge * fix(android): make canvas content access hardening explicit * fix(android): keep webview hardening inline for CodeQL * fix(android): avoid webview getter false positive
27 lines
585 B
YAML
27 lines
585 B
YAML
name: openclaw-codeql-android-critical-security
|
|
|
|
disable-default-queries: true
|
|
|
|
queries:
|
|
- uses: security-extended
|
|
|
|
query-filters:
|
|
# Android canvas intentionally runs trusted A2UI JavaScript; keep this profile focused on exploitable WebView edges.
|
|
- exclude:
|
|
id: java/android/websettings-javascript-enabled
|
|
|
|
paths:
|
|
- apps/android/app/src/main
|
|
|
|
paths-ignore:
|
|
- "**/.gradle"
|
|
- "**/build"
|
|
- "**/node_modules"
|
|
- "**/coverage"
|
|
- "**/*.generated.*"
|
|
- "**/*Test.kt"
|
|
- "**/*Test.java"
|
|
- "**/*Benchmark.kt"
|
|
- apps/android/app/src/test
|
|
- apps/android/benchmark
|