DollhouseMCP

name: "CodeQL config" # Paths to ignore during analysis paths-ignore: - test/__tests__/security/regexValidator.test.ts - 'test/**/*.test.ts' # Query filters to exclude specific alerts # FIX: Use correct array syntax for id field (CodeQL documentation) query-filters: - exclude: id: - js/polynomial-redos - js/redos paths: - "test/**" - exclude: id: - js/prototype-polluting-assignment - js/prototype-pollution-utility paths: - "src/config/ConfigManager.ts" # Additional documentation # These test files intentionally contain vulnerable regex patterns # to test our security validation mechanisms # ConfigManager.ts prototype pollution alerts are false positives: # The code validates all keys with validatePropertyPath() before any assignments