Skip to content

Commit 3c41835

Browse files
asgerfasgerf
authored
Merge branch 'main' into rb/conditional-bypass-sink
2 parents 9d600d4 + 16634e6 commit 3c41835

File tree

235 files changed

+17285
-6318
lines changed

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

235 files changed

+17285
-6318
lines changed

‎actions/ql/lib/change-notes/2025-01-20-bash.md‎

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,4 @@
1+
---
2+
category: fix
3+
---
4+
* Improved `untrustedGhCommandDataModel` regex for `gh pr view` and Bash taint analysis in GitHub Actions.

‎actions/ql/lib/change-notes/2025-01-22-version.md‎

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,4 @@
1+
---
2+
category: fix
3+
---
4+
* Fixed data for vulnerable versions of `actions/download-artifact` and `rlespinasse/github-slug-action` (following GHSA-cxww-7g56-2vh6 and GHSA-6q4m-7476-932w).

‎actions/ql/lib/codeql/actions/Bash.qll‎

Lines changed: 13 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -695,6 +695,19 @@ module Bash {
695695
not varMatchesRegexTest(script, var2, alphaNumericRegex())
696696
)
697697
or
698+
exists(string var2, string value2, string var3, string value3 |
699+
// VAR2=$(cmd)
700+
// VAR3=$VAR2
701+
// echo "FIELD=${VAR3:-default}" >> $GITHUB_ENV (field, file_write_value)
702+
containsCmdSubstitution(value2, cmd) and
703+
script.getAnAssignment(var2, value2) and
704+
containsParameterExpansion(value3, var2, _, _) and
705+
script.getAnAssignment(var3, value3) and
706+
containsParameterExpansion(expr, var3, _, _) and
707+
not varMatchesRegexTest(script, var2, alphaNumericRegex()) and
708+
not varMatchesRegexTest(script, var3, alphaNumericRegex())
709+
)
710+
or
698711
// var reaches the file write directly
699712
// echo "FIELD=$(cmd)" >> $GITHUB_ENV (field, file_write_value)
700713
containsCmdSubstitution(expr, cmd)

‎actions/ql/lib/codeql/actions/controlflow/internal/Cfg.qll‎

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -134,6 +134,10 @@ private module Implementation implements CfgShared::InputSig<Location> {
134134
SuccessorType getAMatchingSuccessorType(Completion c) { result = c.getAMatchingSuccessorType() }
135135

136136
predicate isAbnormalExitType(SuccessorType t) { none() }
137+
138+
int idOfAstNode(AstNode node) { none() }
139+
140+
int idOfCfgScope(CfgScope scope) { none() }
137141
}
138142

139143
module CfgImpl = CfgShared::Make<Location, Implementation>;

‎actions/ql/lib/ext/config/untrusted_gh_command.yml‎

Lines changed: 12 additions & 9 deletions
Original file line numberDiff line numberDiff line change
@@ -7,26 +7,29 @@ extensions:
77
# PULL REQUESTS
88
#
99
# HEAD_REF=$(gh pr view "${{ github.event.issue.number }}" --json headRefName -q '.headRefName')
10-
- ["gh\\s+pr\\b.*\\bview\\b.*\\.headRefName.*", "branch,oneline"]
10+
- ["gh\\s+pr\\b.*\\bview\\b.*\\bheadRefName\\b", "branch,oneline"]
1111
# TITLE=$(gh pr view $PR_NUMBER --json title --jq .title)
12-
- ["gh\\s+pr\\b.*\\bview\\b.*\\.title.*", "title,oneline"]
12+
# TITLE=$(gh pr view $PR_NUMBER --json "title")
13+
- ["gh\\s+pr\\b.*\\bview\\b.*\\btitle\\b", "title,oneline"]
1314
# BODY=$(gh pr view $PR_NUMBER --json body --jq .body)
14-
- ["gh\\s+pr\\b.*\\bview\\b.*\\.body.*", "text,multiline"]
15+
- ["gh\\s+pr\\b.*\\bview\\b.*\\bbody\\b", "text,multiline"]
1516
# COMMENTS="$(gh pr view --repo ${{ github.repository }} "$PR_NUMBER" --json "body,comments" -q '.body, .comments[].body')"
16-
- ["gh\\s+pr\\b.*\\bview\\b.*\\.comments.*", "text,multiline"]
17+
- ["gh\\s+pr\\b.*\\bview\\b.*\\bcomments\\b", "text,multiline"]
1718
# CHANGED_FILES="$(gh pr view --repo ${{ github.repository }} ${{ needs.check-comment.outputs.pull_number }} --json files --jq '.files.[].path')"
18-
- ["gh\\s+pr\\b.*\\bview\\b.*\\.files.*", "filename,multiline"]
19+
- ["gh\\s+pr\\b.*\\bview\\b.*\\bfiles\\b", "filename,multiline"]
1920
# AUTHOR=$(gh pr view ${ORI_PR} -R ${REPO} --json author -q '.author.login')
20-
- ["gh\\s+pr\\b.*\\bview\\b.*\\.author.*", "username,oneline"]
21+
- ["gh\\s+pr\\b.*\\bview\\b.*\\bauthor\\b", "username,oneline"]
2122
#
2223
# ISSUES
2324
#
2425
# TITLE=$(gh issue view "$ISSUE_NUMBER" --json title --jq '.title')
25-
- ["gh\\s+issue\\b.*\\bview\\b.*\\.title.*", "title,oneline"]
26+
# TITLE=$(gh issue view "$ISSUE_NUMBER" --json title,body)
27+
# TITLE=$(gh issue view "$ISSUE_NUMBER" --json "title,body")
28+
- ["gh\\s+issue\\b.*\\bview\\b.*\\btitle\\b", "title,oneline"]
2629
# BODY=$(gh issue view -R ${GITHUB_REPOSITORY} ${ORIGINAL_ISSUE_NUMBER} --json title,body,assignees --jq .body)
27-
- ["gh\\s+issue\\b.*\\bview\\b.*\\.body.*", "text,multiline"]
30+
- ["gh\\s+issue\\b.*\\bview\\b.*\\bbody\\b", "text,multiline"]
2831
# COMMENTS=$(gh issue view "$ISSUE_NUMBER" --json comments --jq '.comments[].body')
29-
- ["gh\\s+issue\\b.*\\bview\\b.*\\.comments.*", "text,multiline"]
32+
- ["gh\\s+issue\\b.*\\bview\\b.*\\bcomments\\b", "text,multiline"]
3033
#
3134
# API
3235
#

‎actions/ql/lib/ext/config/vulnerable_actions.yml‎

Lines changed: 6 additions & 60 deletions
Original file line numberDiff line numberDiff line change
@@ -6,38 +6,12 @@ extensions:
66

77
# gh api /repos/actions/download-artifact/tags --jq 'map({name: .name, sha: .commit.sha})' --paginate | jq -r '.[] | "- \"\(.name)\", \"\(.sha)\""'
88

9-
#
109
# actions/download-artifact
11-
- ["actions/download-artifact", "v4.1.6", "9c19ed7fe5d278cd354c7dfd5d3b88589c7e2395", "4.1.7"]
12-
- ["actions/download-artifact", "v4.1.5", "8caf195ad4b1dee92908e23f56eeb0696f1dd42d", "4.1.7"]
13-
- ["actions/download-artifact", "v4.1.4", "c850b930e6ba138125429b7e5c93fc707a7f8427", "4.1.7"]
14-
- ["actions/download-artifact", "v4.1.3", "87c55149d96e628cc2ef7e6fc2aab372015aec85", "4.1.7"]
15-
- ["actions/download-artifact", "v4.1.2", "eaceaf801fd36c7dee90939fad912460b18a1ffe", "4.1.7"]
16-
- ["actions/download-artifact", "v4.1.1", "6b208ae046db98c579e8a3aa621ab581ff575935", "4.1.7"]
17-
- ["actions/download-artifact", "v4.1.0", "f44cd7b40bfd40b6aa1cc1b9b5b7bf03d3c67110", "4.1.7"]
18-
- ["actions/download-artifact", "v4.0.0", "7a1cd3216ca9260cd8022db641d960b1db4d1be4", "4.1.7"]
19-
- ["actions/download-artifact", "v3.0.2", "9bc31d5ccc31df68ecc42ccf4149144866c47d8a", "4.1.7"]
20-
- ["actions/download-artifact", "v3.0.1", "9782bd6a9848b53b110e712e20e42d89988822b7", "4.1.7"]
21-
- ["actions/download-artifact", "v3.0.0", "fb598a63ae348fa914e94cd0ff38f362e927b741", "4.1.7"]
22-
- ["actions/download-artifact", "v3", "9bc31d5ccc31df68ecc42ccf4149144866c47d8a", "4.1.7"]
23-
- ["actions/download-artifact", "v3-node20", "246d7188e736d3686f6d19628d253ede9697bd55", "4.1.7"]
24-
- ["actions/download-artifact", "v2.1.1", "cbed621e49e4c01b044d60f6c80ea4ed6328b281", "4.1.7"]
25-
- ["actions/download-artifact", "v2.1.0", "f023be2c48cc18debc3bacd34cb396e0295e2869", "4.1.7"]
26-
- ["actions/download-artifact", "v2.0.10", "3be87be14a055c47b01d3bd88f8fe02320a9bb60", "4.1.7"]
27-
- ["actions/download-artifact", "v2.0.9", "158ca71f7c614ae705e79f25522ef4658df18253", "4.1.7"]
28-
- ["actions/download-artifact", "v2.0.8", "4a7a711286f30c025902c28b541c10e147a9b843", "4.1.7"]
29-
- ["actions/download-artifact", "v2.0.7", "f144d3c3916a86f4d6b11ff379d17a49d8f85dbc", "4.1.7"]
30-
- ["actions/download-artifact", "v2.0.6", "f8e41fbffeebb48c0273438d220bb2387727471f", "4.1.7"]
31-
- ["actions/download-artifact", "v2.0.5", "c3f5d00c8784369c43779f3d2611769594a61f7a", "4.1.7"]
32-
- ["actions/download-artifact", "v2.0.4", "b3cedea9bed36890c824f4065163b667eeca272b", "4.1.7"]
33-
- ["actions/download-artifact", "v2.0.3", "80d2d4023c185001eacb50e37afd7dd667ba8044", "4.1.7"]
34-
- ["actions/download-artifact", "v2.0.2", "381af06b4268a1e0ad7b7c7e5a09f1894977120f", "4.1.7"]
35-
- ["actions/download-artifact", "v2.0.1", "1ac47ba4b6af92e65d0438b64ce1ea49ce1cc48d", "4.1.7"]
36-
- ["actions/download-artifact", "v2.0", "1de1dea89c32dcb1f37183c96fe85cfe067b682a", "4.1.7"]
37-
- ["actions/download-artifact", "v2", "cbed621e49e4c01b044d60f6c80ea4ed6328b281", "4.1.7"]
38-
- ["actions/download-artifact", "v1.0.0", "18f0f591fbc635562c815484d73b6e8e3980482e", "4.1.7"]
39-
- ["actions/download-artifact", "v1", "18f0f591fbc635562c815484d73b6e8e3980482e", "4.1.7"]
40-
- ["actions/download-artifact", "1.0.0", "18f0f591fbc635562c815484d73b6e8e3980482e", "4.1.7"]
10+
# https://github.com/advisories/GHSA-cxww-7g56-2vh6 Affected versions: >= 4.0.0, < 4.1.3
11+
- ["actions/download-artifact", "v4.1.2", "eaceaf801fd36c7dee90939fad912460b18a1ffe", "4.1.3"]
12+
- ["actions/download-artifact", "v4.1.1", "6b208ae046db98c579e8a3aa621ab581ff575935", "4.1.3"]
13+
- ["actions/download-artifact", "v4.1.0", "f44cd7b40bfd40b6aa1cc1b9b5b7bf03d3c67110", "4.1.3"]
14+
- ["actions/download-artifact", "v4.0.0", "7a1cd3216ca9260cd8022db641d960b1db4d1be4", "4.1.3"]
4115

4216
# tj-actions/changed-files
4317
# https://github.com/advisories/GHSA-mcph-m25j-8j63
@@ -530,22 +504,13 @@ extensions:
530504
- ["gradle/gradle-build-action", "v1", "b3afdc78a7849557ab26e243ccf07548086da025", "2.4.2"]
531505

532506
# rlespinasse/github-slug-action
533-
# https://github.com/advisories/GHSA-6q4m-7476-932w
507+
# https://github.com/advisories/GHSA-6q4m-7476-932w Affected versions: >= 4.0.0, < 4.4.1
534508
# CVE-2023-27581
535-
- ["rlespinasse/github-slug-action", "v4.4.1", "102b1a064a9b145e56556e22b18b19c624538d94", "4.4.1"]
536509
- ["rlespinasse/github-slug-action", "v4.4.0", "a362e5fb42057a3a23a62218b050838f1bacca5d", "4.4.1"]
537510
- ["rlespinasse/github-slug-action", "v4.3.2", "b011e83cf8cb29e22dda828db30586691ae164e4", "4.4.1"]
538511
- ["rlespinasse/github-slug-action", "v4.3.1", "00198f89920d4454e37e4b27af2b7a8eba79c530", "4.4.1"]
539512
- ["rlespinasse/github-slug-action", "v4.3.0", "9c3571fd3dba541bfdaebc001482a49a1c1f136a", "4.4.1"]
540513
- ["rlespinasse/github-slug-action", "v4.2.5", "0141d9b38d1f21c3b3de63229e20b7b0ad7ef0f4", "4.4.1"]
541-
- ["rlespinasse/github-slug-action", "v3.9.0", "2daab132aa3a6e23ea9d409f9946b3bf6468cc77", "4.4.1"]
542-
- ["rlespinasse/github-slug-action", "v3.8.0", "4a00c29bc1c0a737315b4200af6c6991bb4ace18", "4.4.1"]
543-
- ["rlespinasse/github-slug-action", "v3.7.1", "5150a26d43ce06608443c66efea46fc6f3c50d38", "4.4.1"]
544-
- ["rlespinasse/github-slug-action", "v3.7.0", "ebfc49c0e9cd081acb7ba0634d8d6a711b4c73cf", "4.4.1"]
545-
- ["rlespinasse/github-slug-action", "v3", "2daab132aa3a6e23ea9d409f9946b3bf6468cc77", "4.4.1"]
546-
- ["rlespinasse/github-slug-action", "v3.x", "2daab132aa3a6e23ea9d409f9946b3bf6468cc77", "4.4.1"]
547-
- ["rlespinasse/github-slug-action", "v2.x", "9d2c65418d6ecbbd3c08e686997b30482e9f4a80", "4.4.1"]
548-
- ["rlespinasse/github-slug-action", "v1.1.x", "fbf6d7b9c7af4e8d06135dbc7d774e717d788731", "4.4.1"]
549514
- ["rlespinasse/github-slug-action", "4.2.5", "0141d9b38d1f21c3b3de63229e20b7b0ad7ef0f4", "4.4.1"]
550515
- ["rlespinasse/github-slug-action", "4.2.4", "33cd7a701db9c2baf4ad705d930ade51a9f25c14", "4.4.1"]
551516
- ["rlespinasse/github-slug-action", "4.2.3", "1615fcb48b5315152b3733b7bed1a9f5dfada6e3", "4.4.1"]
@@ -555,25 +520,6 @@ extensions:
555520
- ["rlespinasse/github-slug-action", "4.1.0", "88f3ee8f6f5d1955de92f1fe2fdb301fd40207c6", "4.4.1"]
556521
- ["rlespinasse/github-slug-action", "4.0.1", "cd9871b66e11e9562e3f72469772fe100be4c95a", "4.4.1"]
557522
- ["rlespinasse/github-slug-action", "4.0.0", "bd31a9f564f7930eea1ecfc8d0e6aebc4bc3279f", "4.4.1"]
558-
- ["rlespinasse/github-slug-action", "3.6.1", "1bf76b7bc6ef7dc6ba597ff790f956d9082479d7", "4.4.1"]
559-
- ["rlespinasse/github-slug-action", "3.6.0", "172fe43594a58b5938e248ec757ada60cdb17e18", "4.4.1"]
560-
- ["rlespinasse/github-slug-action", "3.5.1", "016823880d193a56b180527cf7ee52f13c3cfe33", "4.4.1"]
561-
- ["rlespinasse/github-slug-action", "3.5.0", "4060fda2690bcebaabcd86db4fbc8e1c2817c835", "4.4.1"]
562-
- ["rlespinasse/github-slug-action", "3.4.0", "0c099abd978b382cb650281af13913c1905fdd50", "4.4.1"]
563-
- ["rlespinasse/github-slug-action", "3.3.0", "d1880ea5b39f611effb9f3f83f4d35bff34083a6", "4.4.1"]
564-
- ["rlespinasse/github-slug-action", "3.2.0", "c8d8ee50d00177c1e80dd57905fc61f81e437279", "4.4.1"]
565-
- ["rlespinasse/github-slug-action", "3.1.0", "e4699e49fcf890a3172a02c56ba78d867dbb9fd5", "4.4.1"]
566-
- ["rlespinasse/github-slug-action", "3.0.0", "6a873bec5ac11c6d2a11756b8763356da63a8939", "4.4.1"]
567-
- ["rlespinasse/github-slug-action", "2.2.0", "9d2c65418d6ecbbd3c08e686997b30482e9f4a80", "4.4.1"]
568-
- ["rlespinasse/github-slug-action", "2.1.1", "72cfc4cb1f36c102c48541cb59511a6267e89c95", "4.4.1"]
569-
- ["rlespinasse/github-slug-action", "2.1.0", "1172ed1802078eb665a55c252fc180138b907c51", "4.4.1"]
570-
- ["rlespinasse/github-slug-action", "2.0.0", "ca9a67fa1f1126b377a9d80dc1ea354284c71d21", "4.4.1"]
571-
- ["rlespinasse/github-slug-action", "1.2.0", "fbf6d7b9c7af4e8d06135dbc7d774e717d788731", "4.4.1"]
572-
- ["rlespinasse/github-slug-action", "1.1.1", "242e04c2d28ac5db296e5d8203dfd7dc6bcc17a9", "4.4.1"]
573-
- ["rlespinasse/github-slug-action", "1.1.0", "881085bcae8c3443a89cc9401f3e1c60fb014ed2", "4.4.1"]
574-
- ["rlespinasse/github-slug-action", "1.0.2", "a35a1a486a260cfd99c5b6f8c6034a2929ba9b3f", "4.4.1"]
575-
- ["rlespinasse/github-slug-action", "1.0.1", "e46186066296e23235242d0877e2b4fe54003d54", "4.4.1"]
576-
- ["rlespinasse/github-slug-action", "1.0.0", "9671420482a6e4c59c06f2d2d9e0605e941b1287", "4.4.1"]
577523

578524
# Azure/setup-kubectl
579525
# https://github.com/advisories/GHSA-p756-rfxh-x63h

‎actions/ql/test/query-tests/Security/CWE-094/.github/workflows/test19.yml‎

Lines changed: 21 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -106,7 +106,27 @@ jobs:
106106
COMMENTS=$(gh api /repos/test/test/pulls/${PR_NUMBER}/comments --jq '.[].body')
107107
echo "comments=$COMMENTS" >> "$GITHUB_OUTPUT"
108108
- run: echo "${{ steps.comments.outputs.comments}}"
109-
109+
pulls3:
110+
runs-on: ubuntu-latest
111+
steps:
112+
- id: title1
113+
run: |
114+
DETAILS=$(gh pr view $PR_NUMBER --json "title,author,headRefName")
115+
TITLE=$(echo $DETAILS | jq -r '.title')
116+
echo "title=$TITLE" >> "$GITHUB_OUTPUT"
117+
- run: echo "${{ steps.title1.outputs.title}}"
118+
- id: title2
119+
run: |
120+
TITLE=$(gh pr view $PR_NUMBER --json "title,author,headRefName")
121+
TITLE=$(echo $TITLE | jq -r '.title')
122+
echo "title=$TITLE" >> "$GITHUB_OUTPUT"
123+
- run: echo "${{ steps.title2.outputs.title}}"
124+
- id: title3
125+
run: |
126+
TITLE=$(gh issue view "$ISSUE_NUMBER" --json title,author)
127+
TITLE=$(echo $TITLE | jq -r '.title')
128+
echo "title=$TITLE" >> "$GITHUB_OUTPUT"
129+
- run: echo "${{ steps.title3.outputs.title}}"
110130

111131

112132

0 commit comments

Comments
 (0)