🌐 AI搜索 & 代理 主页
Skip to content

Commit bc6133d

Browse files
oscarsjoscarsj
committed
Merge branch 'main' of https://github.com/github/codeql into oscarsj/merge-back-rc-3.20
2 parents 5addb53 + 9a95aca commit bc6133d

File tree

602 files changed

+25241
-3611
lines changed

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

602 files changed

+25241
-3611
lines changed

‎.bazelversion‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1 +1 @@
1-
8.1.1
1+
8.4.2

‎.github/dependabot.yml‎

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -40,3 +40,8 @@ updates:
4040
- dependency-name: "*"
4141
reviewers:
4242
- "github/codeql-go"
43+
44+
- package-ecosystem: bazel
45+
directory: "/"
46+
schedule:
47+
interval: weekly

‎MODULE.bazel‎

Lines changed: 5 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -274,11 +274,11 @@ ripunzip_archive = use_repo_rule("//misc/ripunzip:ripunzip.bzl", "ripunzip_archi
274274
# go to https://github.com/GoogleChrome/ripunzip/releases to find latest version and corresponding sha256s
275275
ripunzip_archive(
276276
name = "ripunzip",
277-
sha256_linux = "ee0e8a957687a5dc3a66b2a4b25883bf762df4c9c07f0651af527a32a405054b",
278-
sha256_macos_arm = "8a88eea54eac232d162a72a42065e0429b82dbf4f05e9642915dff9d7a81f846",
279-
sha256_macos_intel = "4457a18bfcc5feabe09f5ea3d1157128e07b4873392cb404a870e611924abf64",
280-
sha256_windows = "66d0c1375301bf5ab815348048f43b110631d3fa7200acd50d50a8ed8655ca62",
281-
version = "2.0.3",
277+
sha256_linux = "71482d7a7e4ea9176d5596161c49250c34b136b157c45f632b1111323fbfc0de",
278+
sha256_macos_arm = "604194ab13f0aba3972995d995f11002b8fc285c8170401fcd46655065df20c9",
279+
sha256_macos_intel = "65367b94fd579d93d46f2d2595cc4c9a60cfcf497e3c824f9d1a7b80fa8bd38a",
280+
sha256_windows = "ac3874075def2b9e5074a3b5945005ab082cc6e689e1de658da8965bc23e643e",
281+
version = "2.0.4",
282282
)
283283

284284
register_toolchains(

‎actions/ql/lib/change-notes/2025-11-28-fix-code-injection-alert-filtering.md‎

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,4 @@
1+
---
2+
category: majorAnalysis
3+
---
4+
* The query `actions/code-injection/medium` has been updated to include results which were incorrectly excluded while filtering out results that are reported by `actions/code-injection/critical`.

‎actions/ql/lib/codeql/actions/security/CodeInjectionQuery.qll‎

Lines changed: 36 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -19,12 +19,7 @@ class CodeInjectionSink extends DataFlow::Node {
1919
Event getRelevantCriticalEventForSink(DataFlow::Node sink) {
2020
inPrivilegedContext(sink.asExpr(), result) and
2121
not exists(ControlCheck check | check.protects(sink.asExpr(), result, "code-injection")) and
22-
// exclude cases where the sink is a JS script and the expression uses toJson
23-
not exists(UsesStep script |
24-
script.getCallee() = "actions/github-script" and
25-
script.getArgumentExpr("script") = sink.asExpr() and
26-
exists(getAToJsonReferenceExpression(sink.asExpr().(Expression).getExpression(), _))
27-
)
22+
not isGithubScriptUsingToJson(sink.asExpr())
2823
}
2924

3025
/**
@@ -91,3 +86,38 @@ private module CodeInjectionConfig implements DataFlow::ConfigSig {
9186

9287
/** Tracks flow of unsafe user input that is used to construct and evaluate a code script. */
9388
module CodeInjectionFlow = TaintTracking::Global<CodeInjectionConfig>;
89+
90+
/**
91+
* Holds if there is a code injection flow from `source` to `sink` with
92+
* critical severity, linked by `event`.
93+
*/
94+
predicate criticalSeverityCodeInjection(
95+
CodeInjectionFlow::PathNode source, CodeInjectionFlow::PathNode sink, Event event
96+
) {
97+
CodeInjectionFlow::flowPath(source, sink) and
98+
event = getRelevantCriticalEventForSink(sink.getNode()) and
99+
source.getNode().(RemoteFlowSource).getEventName() = event.getName()
100+
}
101+
102+
/**
103+
* Holds if there is a code injection flow from `source` to `sink` with medium severity.
104+
*/
105+
predicate mediumSeverityCodeInjection(
106+
CodeInjectionFlow::PathNode source, CodeInjectionFlow::PathNode sink
107+
) {
108+
CodeInjectionFlow::flowPath(source, sink) and
109+
not criticalSeverityCodeInjection(source, sink, _) and
110+
not isGithubScriptUsingToJson(sink.getNode().asExpr())
111+
}
112+
113+
/**
114+
* Holds if `expr` is the `script` input to `actions/github-script` and it uses
115+
* `toJson`.
116+
*/
117+
predicate isGithubScriptUsingToJson(Expression expr) {
118+
exists(UsesStep script |
119+
script.getCallee() = "actions/github-script" and
120+
script.getArgumentExpr("script") = expr and
121+
exists(getAToJsonReferenceExpression(expr.getExpression(), _))
122+
)
123+
}

‎actions/ql/src/Security/CWE-094/CodeInjectionCritical.ql‎

Lines changed: 1 addition & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -20,10 +20,7 @@ import CodeInjectionFlow::PathGraph
2020
import codeql.actions.security.ControlChecks
2121

2222
from CodeInjectionFlow::PathNode source, CodeInjectionFlow::PathNode sink, Event event
23-
where
24-
CodeInjectionFlow::flowPath(source, sink) and
25-
event = getRelevantCriticalEventForSink(sink.getNode()) and
26-
source.getNode().(RemoteFlowSource).getEventName() = event.getName()
23+
where criticalSeverityCodeInjection(source, sink, event)
2724
select sink.getNode(), source, sink,
2825
"Potential code injection in $@, which may be controlled by an external user ($@).", sink,
2926
sink.getNode().asExpr().(Expression).getRawExpression(), event, event.getName()

‎actions/ql/src/Security/CWE-094/CodeInjectionMedium.ql‎

Lines changed: 1 addition & 9 deletions
Original file line numberDiff line numberDiff line change
@@ -19,15 +19,7 @@ import codeql.actions.security.CodeInjectionQuery
1919
import CodeInjectionFlow::PathGraph
2020

2121
from CodeInjectionFlow::PathNode source, CodeInjectionFlow::PathNode sink
22-
where
23-
CodeInjectionFlow::flowPath(source, sink) and
24-
inNonPrivilegedContext(sink.getNode().asExpr()) and
25-
// exclude cases where the sink is a JS script and the expression uses toJson
26-
not exists(UsesStep script |
27-
script.getCallee() = "actions/github-script" and
28-
script.getArgumentExpr("script") = sink.getNode().asExpr() and
29-
exists(getAToJsonReferenceExpression(sink.getNode().asExpr().(Expression).getExpression(), _))
30-
)
22+
where mediumSeverityCodeInjection(source, sink)
3123
select sink.getNode(), source, sink,
3224
"Potential code injection in $@, which may be controlled by an external user.", sink,
3325
sink.getNode().asExpr().(Expression).getRawExpression()

‎actions/ql/src/Security/CWE-275/MissingActionsPermissions.md‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -2,6 +2,8 @@
22

33
If a GitHub Actions job or workflow has no explicit permissions set, then the repository permissions are used. Repositories created under organizations inherit the organization permissions. The organizations or repositories created before February 2023 have the default permissions set to read-write. Often these permissions do not adhere to the principle of least privilege and can be reduced to read-only, leaving the `write` permission only to a specific types as `issues: write` or `pull-requests: write`.
44

5+
Note that this query cannot check whether the organization or repository token settings are set to read-only. However, even if they are, it is recommended to define explicit permissions (`contents: read` and `packages: read` are equivalent to the read-only default) so that (a) the actual needs of the workflow are documented, and (b) the permissions will remain restricted if the default is subsequently changed, or the workflow is copied to a different repository or organization.
6+
57
## Recommendation
68

79
Add the `permissions` key to the job or the root of workflow (in this case it is applied to all jobs in the workflow that do not have their own `permissions` key) and assign the least privileges required to complete the task.

‎actions/ql/test/query-tests/Security/CWE-094/.github/workflows/push_and_workflow_dispatch.yml‎

Lines changed: 18 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,18 @@
1+
on:
2+
push:
3+
workflow_dispatch:
4+
5+
jobs:
6+
echo-chamber:
7+
runs-on: ubuntu-latest
8+
steps:
9+
- run: echo '${{ github.event.commits[11].message }}'
10+
- run: echo '${{ github.event.commits[11].author.email }}'
11+
- run: echo '${{ github.event.commits[11].author.name }}'
12+
- run: echo '${{ github.event.head_commit.message }}'
13+
- run: echo '${{ github.event.head_commit.author.email }}'
14+
- run: echo '${{ github.event.head_commit.author.name }}'
15+
- run: echo '${{ github.event.head_commit.committer.email }}'
16+
- run: echo '${{ github.event.head_commit.committer.name }}'
17+
- run: echo '${{ github.event.commits[11].committer.email }}'
18+
- run: echo '${{ github.event.commits[11].committer.name }}'

‎actions/ql/test/query-tests/Security/CWE-094/CodeInjectionCritical.expected‎

Lines changed: 10 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -435,6 +435,16 @@ nodes
435435
| .github/workflows/push.yml:14:19:14:64 | github.event.head_commit.committer.name | semmle.label | github.event.head_commit.committer.name |
436436
| .github/workflows/push.yml:15:19:15:65 | github.event.commits[11].committer.email | semmle.label | github.event.commits[11].committer.email |
437437
| .github/workflows/push.yml:16:19:16:64 | github.event.commits[11].committer.name | semmle.label | github.event.commits[11].committer.name |
438+
| .github/workflows/push_and_workflow_dispatch.yml:9:19:9:57 | github.event.commits[11].message | semmle.label | github.event.commits[11].message |
439+
| .github/workflows/push_and_workflow_dispatch.yml:10:19:10:62 | github.event.commits[11].author.email | semmle.label | github.event.commits[11].author.email |
440+
| .github/workflows/push_and_workflow_dispatch.yml:11:19:11:61 | github.event.commits[11].author.name | semmle.label | github.event.commits[11].author.name |
441+
| .github/workflows/push_and_workflow_dispatch.yml:12:19:12:57 | github.event.head_commit.message | semmle.label | github.event.head_commit.message |
442+
| .github/workflows/push_and_workflow_dispatch.yml:13:19:13:62 | github.event.head_commit.author.email | semmle.label | github.event.head_commit.author.email |
443+
| .github/workflows/push_and_workflow_dispatch.yml:14:19:14:61 | github.event.head_commit.author.name | semmle.label | github.event.head_commit.author.name |
444+
| .github/workflows/push_and_workflow_dispatch.yml:15:19:15:65 | github.event.head_commit.committer.email | semmle.label | github.event.head_commit.committer.email |
445+
| .github/workflows/push_and_workflow_dispatch.yml:16:19:16:64 | github.event.head_commit.committer.name | semmle.label | github.event.head_commit.committer.name |
446+
| .github/workflows/push_and_workflow_dispatch.yml:17:19:17:65 | github.event.commits[11].committer.email | semmle.label | github.event.commits[11].committer.email |
447+
| .github/workflows/push_and_workflow_dispatch.yml:18:19:18:64 | github.event.commits[11].committer.name | semmle.label | github.event.commits[11].committer.name |
438448
| .github/workflows/reusable-workflow-1.yml:6:7:6:11 | input taint | semmle.label | input taint |
439449
| .github/workflows/reusable-workflow-1.yml:36:21:36:39 | inputs.taint | semmle.label | inputs.taint |
440450
| .github/workflows/reusable-workflow-1.yml:44:19:44:56 | github.event.pull_request.title | semmle.label | github.event.pull_request.title |

0 commit comments

Comments
 (0)