Skip to content

Commit 819a122

Browse files
geoffw0geoffw0
authored
Merge branch 'main' into copilot/add-ecb-cbc-test-cases
2 parents 5893dc6 + fe18e0e commit 819a122

File tree

1,239 files changed

+52506
-9075
lines changed

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

1,239 files changed

+52506
-9075
lines changed

‎.bazelversion‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1 +1 @@
1-
8.1.1
1+
8.4.2

‎.github/dependabot.yml‎

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -40,3 +40,8 @@ updates:
4040
- dependency-name: "*"
4141
reviewers:
4242
- "github/codeql-go"
43+
44+
- package-ecosystem: bazel
45+
directory: "/"
46+
schedule:
47+
interval: weekly

‎MODULE.bazel‎

Lines changed: 6 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -23,7 +23,7 @@ bazel_dep(name = "rules_shell", version = "0.5.0")
2323
bazel_dep(name = "bazel_skylib", version = "1.8.1")
2424
bazel_dep(name = "abseil-cpp", version = "20240116.1", repo_name = "absl")
2525
bazel_dep(name = "nlohmann_json", version = "3.11.3", repo_name = "json")
26-
bazel_dep(name = "fmt", version = "10.0.0")
26+
bazel_dep(name = "fmt", version = "12.1.0-codeql.1")
2727
bazel_dep(name = "rules_kotlin", version = "2.1.3-codeql.1")
2828
bazel_dep(name = "gazelle", version = "0.40.0")
2929
bazel_dep(name = "rules_dotnet", version = "0.19.2-codeql.1")
@@ -274,11 +274,11 @@ ripunzip_archive = use_repo_rule("//misc/ripunzip:ripunzip.bzl", "ripunzip_archi
274274
# go to https://github.com/GoogleChrome/ripunzip/releases to find latest version and corresponding sha256s
275275
ripunzip_archive(
276276
name = "ripunzip",
277-
sha256_linux = "ee0e8a957687a5dc3a66b2a4b25883bf762df4c9c07f0651af527a32a405054b",
278-
sha256_macos_arm = "8a88eea54eac232d162a72a42065e0429b82dbf4f05e9642915dff9d7a81f846",
279-
sha256_macos_intel = "4457a18bfcc5feabe09f5ea3d1157128e07b4873392cb404a870e611924abf64",
280-
sha256_windows = "66d0c1375301bf5ab815348048f43b110631d3fa7200acd50d50a8ed8655ca62",
281-
version = "2.0.3",
277+
sha256_linux = "71482d7a7e4ea9176d5596161c49250c34b136b157c45f632b1111323fbfc0de",
278+
sha256_macos_arm = "604194ab13f0aba3972995d995f11002b8fc285c8170401fcd46655065df20c9",
279+
sha256_macos_intel = "65367b94fd579d93d46f2d2595cc4c9a60cfcf497e3c824f9d1a7b80fa8bd38a",
280+
sha256_windows = "ac3874075def2b9e5074a3b5945005ab082cc6e689e1de658da8965bc23e643e",
281+
version = "2.0.4",
282282
)
283283

284284
register_toolchains(

‎actions/ql/lib/CHANGELOG.md‎

Lines changed: 8 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1,3 +1,11 @@
1+
## 0.4.23
2+
3+
No user-facing changes.
4+
5+
## 0.4.22
6+
7+
No user-facing changes.
8+
19
## 0.4.21
210

311
No user-facing changes.

‎actions/ql/lib/change-notes/2025-11-28-fix-code-injection-alert-filtering.md‎

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,4 @@
1+
---
2+
category: majorAnalysis
3+
---
4+
* The query `actions/code-injection/medium` has been updated to include results which were incorrectly excluded while filtering out results that are reported by `actions/code-injection/critical`.

‎actions/ql/lib/change-notes/released/0.4.22.md‎

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,3 @@
1+
## 0.4.22
2+
3+
No user-facing changes.

‎actions/ql/lib/change-notes/released/0.4.23.md‎

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,3 @@
1+
## 0.4.23
2+
3+
No user-facing changes.

‎actions/ql/lib/codeql-pack.release.yml‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,2 +1,2 @@
11
---
2-
lastReleaseVersion: 0.4.21
2+
lastReleaseVersion: 0.4.23

‎actions/ql/lib/codeql/actions/security/CodeInjectionQuery.qll‎

Lines changed: 36 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -19,12 +19,7 @@ class CodeInjectionSink extends DataFlow::Node {
1919
Event getRelevantCriticalEventForSink(DataFlow::Node sink) {
2020
inPrivilegedContext(sink.asExpr(), result) and
2121
not exists(ControlCheck check | check.protects(sink.asExpr(), result, "code-injection")) and
22-
// exclude cases where the sink is a JS script and the expression uses toJson
23-
not exists(UsesStep script |
24-
script.getCallee() = "actions/github-script" and
25-
script.getArgumentExpr("script") = sink.asExpr() and
26-
exists(getAToJsonReferenceExpression(sink.asExpr().(Expression).getExpression(), _))
27-
)
22+
not isGithubScriptUsingToJson(sink.asExpr())
2823
}
2924

3025
/**
@@ -91,3 +86,38 @@ private module CodeInjectionConfig implements DataFlow::ConfigSig {
9186

9287
/** Tracks flow of unsafe user input that is used to construct and evaluate a code script. */
9388
module CodeInjectionFlow = TaintTracking::Global<CodeInjectionConfig>;
89+
90+
/**
91+
* Holds if there is a code injection flow from `source` to `sink` with
92+
* critical severity, linked by `event`.
93+
*/
94+
predicate criticalSeverityCodeInjection(
95+
CodeInjectionFlow::PathNode source, CodeInjectionFlow::PathNode sink, Event event
96+
) {
97+
CodeInjectionFlow::flowPath(source, sink) and
98+
event = getRelevantCriticalEventForSink(sink.getNode()) and
99+
source.getNode().(RemoteFlowSource).getEventName() = event.getName()
100+
}
101+
102+
/**
103+
* Holds if there is a code injection flow from `source` to `sink` with medium severity.
104+
*/
105+
predicate mediumSeverityCodeInjection(
106+
CodeInjectionFlow::PathNode source, CodeInjectionFlow::PathNode sink
107+
) {
108+
CodeInjectionFlow::flowPath(source, sink) and
109+
not criticalSeverityCodeInjection(source, sink, _) and
110+
not isGithubScriptUsingToJson(sink.getNode().asExpr())
111+
}
112+
113+
/**
114+
* Holds if `expr` is the `script` input to `actions/github-script` and it uses
115+
* `toJson`.
116+
*/
117+
predicate isGithubScriptUsingToJson(Expression expr) {
118+
exists(UsesStep script |
119+
script.getCallee() = "actions/github-script" and
120+
script.getArgumentExpr("script") = expr and
121+
exists(getAToJsonReferenceExpression(expr.getExpression(), _))
122+
)
123+
}

‎actions/ql/lib/qlpack.yml‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,5 @@
11
name: codeql/actions-all
2-
version: 0.4.22-dev
2+
version: 0.4.24-dev
33
library: true
44
warnOnImplicitThis: true
55
dependencies:

0 commit comments

Comments
 (0)