Merge remote-tracking branch 'origin/main' into nickrolfe/misspelling

javascript/ql/lib/semmle/javascript/Actions.qll

@@ -0,0 +1,252 @@
+/**
+ * Libraries for modeling GitHub Actions workflow files written in YAML.
+ * See https://docs.github.com/en/actions/reference/workflow-syntax-for-github-actions.
+ */
+
+import javascript
+
+/**
+ * Libraries for modeling GitHub Actions workflow files written in YAML.
+ * See https://docs.github.com/en/actions/reference/workflow-syntax-for-github-actions.
+ */
+module Actions {
+  /** A YAML node in a GitHub Actions workflow file. */
+  private class Node extends YAMLNode {
+    Node() {
+      this.getLocation()
+          .getFile()
+          .getRelativePath()
+          .regexpMatch("(^|.*/)\\.github/workflows/.*\\.yml$")
+    }
+  }
+
+  /**
+   * An Actions workflow. This is a mapping at the top level of an Actions YAML workflow file.
+   * See https://docs.github.com/en/actions/reference/workflow-syntax-for-github-actions.
+   */
+  class Workflow extends Node, YAMLDocument, YAMLMapping {
+    /** Gets the `jobs` mapping from job IDs to job definitions in this workflow. */
+    YAMLMapping getJobs() { result = this.lookup("jobs") }
+
+    /** Gets the name of the workflow file. */
+    string getFileName() { result = this.getFile().getBaseName() }
+
+    /** Gets the `on:` in this workflow. */
+    On getOn() { result = this.lookup("on") }
+
+    /** Gets the job within this workflow with the given job ID. */
+    Job getJob(string jobId) { result.getWorkflow() = this and result.getId() = jobId }
+  }
+
+  /**
+   * An Actions On trigger within a workflow.
+   * See https://docs.github.com/en/actions/reference/workflow-syntax-for-github-actions#on.
+   */
+  class On extends YAMLNode, YAMLMappingLikeNode {
+    Workflow workflow;
+
+    On() { workflow.lookup("on") = this }
+
+    /** Gets the workflow that this trigger is in. */
+    Workflow getWorkflow() { result = workflow }
+  }
+
+  /**
+   * An Actions job within a workflow.
+   * See https://docs.github.com/en/actions/reference/workflow-syntax-for-github-actions#jobs.
+   */
+  class Job extends YAMLNode, YAMLMapping {
+    string jobId;
+    Workflow workflow;
+
+    Job() { this = workflow.getJobs().lookup(jobId) }
+
+    /**
+     * Gets the ID of this job, as a string.
+     * This is the job's key within the `jobs` mapping.
+     */
+    string getId() { result = jobId }
+
+    /**
+     * Gets the ID of this job, as a YAML scalar node.
+     * This is the job's key within the `jobs` mapping.
+     */
+    YAMLString getIdNode() { workflow.getJobs().maps(result, this) }
+
+    /** Gets the human-readable name of this job, if any, as a string. */
+    string getName() { result = this.getNameNode().getValue() }
+
+    /** Gets the human-readable name of this job, if any, as a YAML scalar node. */
+    YAMLString getNameNode() { result = this.lookup("name") }
+
+    /** Gets the step at the given index within this job. */
+    Step getStep(int index) { result.getJob() = this and result.getIndex() = index }
+
+    /** Gets the sequence of `steps` within this job. */
+    YAMLSequence getSteps() { result = this.lookup("steps") }
+
+    /** Gets the workflow this job belongs to. */
+    Workflow getWorkflow() { result = workflow }
+
+    /** Gets the value of the `if` field in this job, if any. */
+    JobIf getIf() { result.getJob() = this }
+  }
+
+  /**
+   * An `if` within a job.
+   * See https://docs.github.com/en/actions/reference/workflow-syntax-for-github-actions#jobsjob_idif.
+   */
+  class JobIf extends YAMLNode, YAMLScalar {
+    Job job;
+
+    JobIf() { job.lookup("if") = this }
+
+    /** Gets the step this field belongs to. */
+    Job getJob() { result = job }
+  }
+
+  /**
+   * A step within an Actions job.
+   * See https://docs.github.com/en/actions/reference/workflow-syntax-for-github-actions#jobsjob_idsteps.
+   */
+  class Step extends YAMLNode, YAMLMapping {
+    int index;
+    Job job;
+
+    Step() { this = job.getSteps().getElement(index) }
+
+    /** Gets the 0-based position of this step within the sequence of `steps`. */
+    int getIndex() { result = index }
+
+    /** Gets the job this step belongs to. */
+    Job getJob() { result = job }
+
+    /** Gets the value of the `uses` field in this step, if any. */
+    Uses getUses() { result.getStep() = this }
+
+    /** Gets the value of the `run` field in this step, if any. */
+    Run getRun() { result.getStep() = this }
+
+    /** Gets the value of the `if` field in this step, if any. */
+    StepIf getIf() { result.getStep() = this }
+  }
+
+  /**
+   * An `if` within a step.
+   * See https://docs.github.com/en/actions/reference/workflow-syntax-for-github-actions#jobsjob_idstepsif.
+   */
+  class StepIf extends YAMLNode, YAMLScalar {
+    Step step;
+
+    StepIf() { step.lookup("if") = this }
+
+    /** Gets the step this field belongs to. */
+    Step getStep() { result = step }
+  }
+
+  /**
+   * Gets a regular expression that parses an `owner/repo@version` reference within a `uses` field in an Actions job step.
+   * The capture groups are:
+   * 1: The owner of the repository where the Action comes from, e.g. `actions` in `actions/checkout@v2`
+   * 2: The name of the repository where the Action comes from, e.g. `checkout` in `actions/checkout@v2`.
+   * 3: The version reference used when checking out the Action, e.g. `v2` in `actions/checkout@v2`.
+   */
+  private string usesParser() { result = "([^/]+)/([^/@]+)@(.+)" }
+
+  /**
+   * A `uses` field within an Actions job step, which references an action as a reusable unit of code.
+   * See https://docs.github.com/en/actions/reference/workflow-syntax-for-github-actions#jobsjob_idstepsuses.
+   *
+   * For example:
+   * ```
+   * uses: actions/checkout@v2
+   * ```
+   *
+   * Does not handle local repository references, e.g. `.github/actions/action-name`.
+   */
+  class Uses extends YAMLNode, YAMLScalar {
+    Step step;
+
+    Uses() { step.lookup("uses") = this }
+
+    /** Gets the step this field belongs to. */
+    Step getStep() { result = step }
+
+    /** Gets the owner and name of the repository where the Action comes from, e.g. `actions/checkout` in `actions/checkout@v2`. */
+    string getGitHubRepository() {
+      result =
+        this.getValue().regexpCapture(usesParser(), 1) + "/" +
+          this.getValue().regexpCapture(usesParser(), 2)
+    }
+
+    /** Gets the version reference used when checking out the Action, e.g. `v2` in `actions/checkout@v2`. */
+    string getVersion() { result = this.getValue().regexpCapture(usesParser(), 3) }
+  }
+
+  /**
+   * A `with` field within an Actions job step, which references an action as a reusable unit of code.
+   * See https://docs.github.com/en/actions/reference/workflow-syntax-for-github-actions#jobsjob_idstepswith.
+   *
+   * For example:
+   * ```
+   * with:
+   *   arg1: 1
+   *   arg2: abc
+   * ```
+   */
+  class With extends YAMLNode, YAMLMapping {
+    Step step;
+
+    With() { step.lookup("with") = this }
+
+    /** Gets the step this field belongs to. */
+    Step getStep() { result = step }
+  }
+
+  /**
+   * A `ref:` field within an Actions `with:` specific to `actions/checkout` action.
+   *
+   * For example:
+   * ```
+   * uses: actions/checkout@v2
+   * with:
+   *   ref: ${{ github.event.pull_request.head.sha }}
+   * ```
+   */
+  class Ref extends YAMLNode, YAMLString {
+    With with;
+
+    Ref() { with.lookup("ref") = this }
+
+    /** Gets the `with` field this field belongs to. */
+    With getWith() { result = with }
+  }
+
+  /**
+   * A `run` field within an Actions job step, which runs command-line programs using an operating system shell.
+   * See https://docs.github.com/en/free-pro-team@latest/actions/reference/workflow-syntax-for-github-actions#jobsjob_idstepsrun.
+   */
+  class Run extends YAMLNode, YAMLString {
+    Step step;
+
+    Run() { step.lookup("run") = this }
+
+    /** Gets the step that executes this `run` command. */
+    Step getStep() { result = step }
+
+    /**
+     * Holds if `${{ e }}` is a GitHub Actions expression evaluated within this `run` command.
+     * See https://docs.github.com/en/free-pro-team@latest/actions/reference/context-and-expression-syntax-for-github-actions.
+     * Only finds simple expressions like `${{ github.event.comment.body }}`, where the expression contains only alphanumeric characters, underscores, dots, or dashes.
+     * Does not identify more complicated expressions like `${{ fromJSON(env.time) }}`, or ${{ format('{{Hello {0}!}}', github.event.head_commit.author.name) }}
+     */
+    string getASimpleReferenceExpression() {
+      // We use `regexpFind` to obtain *all* matches of `${{...}}`,
+      // not just the last (greedy match) or first (reluctant match).
+      result =
+        this.getValue()
+            .regexpFind("\\$\\{\\{\\s*[A-Za-z0-9_\\.\\-]+\\s*\\}\\}", _, _)
+            .regexpCapture("\\$\\{\\{\\s*([A-Za-z0-9_\\.\\-]+)\\s*\\}\\}", 1)
+    }
+  }
+}

javascript/ql/lib/semmle/javascript/NodeModuleResolutionImpl.qll

@@ -96,7 +96,7 @@ File resolveMainModule(PackageJson pkg, int priority) {
     or
     result = tryExtensions(main.resolve(), "index", priority)
     or
-    not exists(main.resolve()) and
+    not main.resolve() instanceof File and
     exists(int n | n = main.getNumComponent() |
       result = tryExtensions(main.resolveUpTo(n - 1), getStem(main.getComponent(n - 1)), priority)
     )

javascript/ql/lib/semmle/javascript/YAML.qll

@@ -441,3 +441,74 @@ class YAMLParseError extends @yaml_error, Error {
 
   override string toString() { result = this.getMessage() }
 }
+
+/**
+ * A YAML node that may contain sub-nodes that can be identified by a name.
+ * I.e. a mapping, sequence, or scalar.
+ *
+ * Is used in e.g. GithHub Actions, which is quite flexible in parsing YAML.
+ *
+ * For example:
+ * ```
+ * on: pull_request
+ * ```
+ * and
+ * ```
+ * on: [pull_request]
+ * ```
+ * and
+ * ```
+ * on:
+ *   pull_request:
+ * ```
+ *
+ * are equivalent.
+ */
+class YAMLMappingLikeNode extends YAMLNode {
+  YAMLMappingLikeNode() {
+    this instanceof YAMLMapping
+    or
+    this instanceof YAMLSequence
+    or
+    this instanceof YAMLScalar
+  }
+
+  /** Gets sub-name identified by `name`. */
+  YAMLNode getNode(string name) {
+    exists(YAMLMapping mapping |
+      mapping = this and
+      result = mapping.lookup(name)
+    )
+    or
+    exists(YAMLSequence sequence, YAMLNode node |
+      sequence = this and
+      sequence.getAChildNode() = node and
+      node.eval().toString() = name and
+      result = node
+    )
+    or
+    exists(YAMLScalar scalar |
+      scalar = this and
+      scalar.getValue() = name and
+      result = scalar
+    )
+  }
+
+  /** Gets the number of elements in this mapping or sequence. */
+  int getElementCount() {
+    exists(YAMLMapping mapping |
+      mapping = this and
+      result = mapping.getNumChild() / 2
+    )
+    or
+    exists(YAMLSequence sequence |
+      sequence = this and
+      result = sequence.getNumChild()
+    )
+    or
+    exists(YAMLScalar scalar |
+      scalar = this and
+      result = 1
+    )
+  }
+}

javascript/ql/lib/semmle/javascript/security/performance/ReDoSUtil.qll

@@ -610,16 +610,23 @@ State after(RegExpTerm t) {
   or
   exists(RegExpGroup grp | t = grp.getAChild() | result = after(grp))
   or
-  exists(EffectivelyStar star | t = star.getAChild() | result = before(star))
+  exists(EffectivelyStar star | t = star.getAChild() |
+    not isPossessive(star) and
+    result = before(star)
+  )
   or
   exists(EffectivelyPlus plus | t = plus.getAChild() |
-    result = before(plus) or
+    not isPossessive(plus) and
+    result = before(plus)
+    or
     result = after(plus)
   )
   or
   exists(EffectivelyQuestion opt | t = opt.getAChild() | result = after(opt))
   or
-  exists(RegExpRoot root | t = root | result = AcceptAnySuffix(root))
+  exists(RegExpRoot root | t = root |
+    if matchesAnySuffix(root) then result = AcceptAnySuffix(root) else result = Accept(root)
+  )
 }
 
 /**
@@ -690,7 +697,7 @@ predicate delta(State q1, EdgeLabel lbl, State q2) {
     lbl = Epsilon() and q2 = Accept(root)
   )
   or
-  exists(RegExpRoot root | q1 = Match(root, 0) | lbl = Any() and q2 = q1)
+  exists(RegExpRoot root | q1 = Match(root, 0) | matchesAnyPrefix(root) and lbl = Any() and q2 = q1)
   or
   exists(RegExpDollar dollar | q1 = before(dollar) |
     lbl = Epsilon() and q2 = Accept(getRoot(dollar))

javascript/ql/lib/semmle/javascript/security/performance/ReDoSUtilSpecific.qll

@@ -12,6 +12,24 @@ predicate isEscapeClass(RegExpTerm term, string clazz) {
   exists(RegExpCharacterClassEscape escape | term = escape | escape.getValue() = clazz)
 }
 
+/**
+ * Holds if `term` is a possessive quantifier.
+ * As javascript's regexes do not support possessive quantifiers, this never holds, but is used by the shared library.
+ */
+predicate isPossessive(RegExpQuantifier term) { none() }
+
+/**
+ * Holds if the regex that `term` is part of is used in a way that ignores any leading prefix of the input it's matched against.
+ * Not yet implemented for Javascript.
+ */
+predicate matchesAnyPrefix(RegExpTerm term) { any() }
+
+/**
+ * Holds if the regex that `term` is part of is used in a way that ignores any trailing suffix of the input it's matched against.
+ * Not yet implemented for Javascript.
+ */
+predicate matchesAnySuffix(RegExpTerm term) { any() }
+
 /**
  * Holds if the regular expression should not be considered.
  *

javascript/ql/src/Security/CWE-094/ExpressionInjection.qhelp

@@ -2,53 +2,47 @@
 "-//Semmle//qhelp//EN"
 "qhelp.dtd">
 <qhelp>
-
 	<overview>
-
 		<p>
-
 			Using user-controlled input in GitHub Actions may lead to
 			code injection in contexts like <i>run:</i> or <i>script:</i>.
-
 		</p>
-
+        <p>
+            Code injection in GitHub Actions may allow an attacker to 
+            exfiltrate the temporary GitHub repository authorization token. 
+            The token might have write access to the repository, allowing an attacker
+             to use the token to make changes to the repository.
+        </p>
 	</overview>
 
 	<recommendation>
-
 		<p>
-
 			The best practice to avoid code injection vulnerabilities
 			in GitHub workflows is to set the untrusted input value of the expression
 			to an intermediate environment variable.
-
 		</p>
-
+        <p>
+            It is also recommended to limit the permissions of any tokens used 
+            by a workflow such as the the GITHUB_TOKEN. 
+        </p>
 	</recommendation>
 
 	<example>
-
 		<p>
-
 			The following example lets a user inject an arbitrary shell command:
-
 		</p>
-
 		<sample src="examples/comment_issue_bad.yml" />
 
 		<p>
-
 			The following example uses shell syntax to read
 			the environment variable and will prevent the attack:
-
 		</p>
-
 		<sample src="examples/comment_issue_good.yml" />
-
 	</example>
 
 	<references>
 		<li>GitHub Security Lab Research: <a href="https://securitylab.github.com/research/github-actions-untrusted-input">Keeping your GitHub Actions and workflows secure: Untrusted input</a>.</li>
+        <li>GitHub Docs: <a href="https://docs.github.com/en/actions/security-guides/security-hardening-for-github-actions">Security hardening for GitHub Actions</a>.</li>
+        <li>GitHub Docs: <a href="https://docs.github.com/en/actions/security-guides/automatic-token-authentication#permissions-for-the-github_token">Permissions for the GITHUB_TOKEN</a>.</li>
 	</references>
-
 </qhelp>

javascript/ql/src/Security/CWE-094/ExpressionInjection.ql

@@ -3,7 +3,8 @@
  * @description Using user-controlled GitHub Actions contexts like `run:` or `script:` may allow a malicious
  *              user to inject code into the GitHub action.
  * @kind problem
- * @problem.severity error
+ * @problem.severity warning
+ * @security-severity 9.3
  * @precision high
  * @id js/actions/injection
  * @tags actions
@@ -12,7 +13,7 @@
  */
 
 import javascript
-import experimental.semmle.javascript.Actions
+import semmle.javascript.Actions
 
 bindingset[context]
 private predicate isExternalUserControlledIssue(string context) {
@@ -22,14 +23,18 @@ private predicate isExternalUserControlledIssue(string context) {
 
 bindingset[context]
 private predicate isExternalUserControlledPullRequest(string context) {
-  context.regexpMatch("\\bgithub\\s*\\.\\s*event\\s*\\.\\s*pull_request\\s*\\.\\s*title\\b") or
-  context.regexpMatch("\\bgithub\\s*\\.\\s*event\\s*\\.\\s*pull_request\\s*\\.\\s*body\\b") or
-  context
-      .regexpMatch("\\bgithub\\s*\\.\\s*event\\s*\\.\\s*pull_request\\s*\\.\\s*head\\s*\\.\\s*label\\b") or
-  context
-      .regexpMatch("\\bgithub\\s*\\.\\s*event\\s*\\.\\s*pull_request\\s*\\.\\s*head\\s*\\.\\s*repo\\s*\\.\\s*default_branch\\b") or
-  context
-      .regexpMatch("\\bgithub\\s*\\.\\s*event\\s*\\.\\s*pull_request\\s*\\.\\s*head\\s*\\.\\s*ref\\b")
+  exists(string reg |
+    reg =
+      [
+        "\\bgithub\\s*\\.\\s*event\\s*\\.\\s*pull_request\\s*\\.\\s*title\\b",
+        "\\bgithub\\s*\\.\\s*event\\s*\\.\\s*pull_request\\s*\\.\\s*body\\b",
+        "\\bgithub\\s*\\.\\s*event\\s*\\.\\s*pull_request\\s*\\.\\s*head\\s*\\.\\s*label\\b",
+        "\\bgithub\\s*\\.\\s*event\\s*\\.\\s*pull_request\\s*\\.\\s*head\\s*\\.\\s*repo\\s*\\.\\s*default_branch\\b",
+        "\\bgithub\\s*\\.\\s*event\\s*\\.\\s*pull_request\\s*\\.\\s*head\\s*\\.\\s*ref\\b",
+      ]
+  |
+    context.regexpMatch(reg)
+  )
 }
 
 bindingset[context]
@@ -51,18 +56,20 @@ private predicate isExternalUserControlledGollum(string context) {
 
 bindingset[context]
 private predicate isExternalUserControlledCommit(string context) {
-  context
-      .regexpMatch("\\bgithub\\s*\\.\\s*event\\s*\\.\\s*commits(?:\\[[0-9]\\]|\\s*\\.\\s*\\*)+\\s*\\.\\s*message\\b") or
-  context.regexpMatch("\\bgithub\\s*\\.\\s*event\\s*\\.\\s*head_commit\\s*\\.\\s*message\\b") or
-  context
-      .regexpMatch("\\bgithub\\s*\\.\\s*event\\s*\\.\\s*head_commit\\s*\\.\\s*author\\s*\\.\\s*email\\b") or
-  context
-      .regexpMatch("\\bgithub\\s*\\.\\s*event\\s*\\.\\s*head_commit\\s*\\.\\s*author\\s*\\.\\s*name\\b") or
-  context
-      .regexpMatch("\\bgithub\\s*\\.\\s*event\\s*\\.\\s*commits(?:\\[[0-9]\\]|\\s*\\.\\s*\\*)+\\s*\\.\\s*author\\s*\\.\\s*email\\b") or
-  context
-      .regexpMatch("\\bgithub\\s*\\.\\s*event\\s*\\.\\s*commits(?:\\[[0-9]\\]|\\s*\\.\\s*\\*)+\\s*\\.\\s*author\\s*\\.\\s*name\\b") or
-  context.regexpMatch("\\bgithub\\s*\\.\\s*head_ref\\b")
+  exists(string reg |
+    reg =
+      [
+        "\\bgithub\\s*\\.\\s*event\\s*\\.\\s*commits(?:\\[[0-9]\\]|\\s*\\.\\s*\\*)+\\s*\\.\\s*message\\b",
+        "\\bgithub\\s*\\.\\s*event\\s*\\.\\s*head_commit\\s*\\.\\s*message\\b",
+        "\\bgithub\\s*\\.\\s*event\\s*\\.\\s*head_commit\\s*\\.\\s*author\\s*\\.\\s*email\\b",
+        "\\bgithub\\s*\\.\\s*event\\s*\\.\\s*head_commit\\s*\\.\\s*author\\s*\\.\\s*name\\b",
+        "\\bgithub\\s*\\.\\s*event\\s*\\.\\s*commits(?:\\[[0-9]\\]|\\s*\\.\\s*\\*)+\\s*\\.\\s*author\\s*\\.\\s*email\\b",
+        "\\bgithub\\s*\\.\\s*event\\s*\\.\\s*commits(?:\\[[0-9]\\]|\\s*\\.\\s*\\*)+\\s*\\.\\s*author\\s*\\.\\s*name\\b",
+        "\\bgithub\\s*\\.\\s*head_ref\\b"
+      ]
+  |
+    context.regexpMatch(reg)
+  )
 }
 
 bindingset[context]
@@ -73,7 +80,7 @@ private predicate isExternalUserControlledDiscussion(string context) {
 
 from Actions::Run run, string context, Actions::On on
 where
-  run.getAReferencedExpression() = context and
+  run.getASimpleReferenceExpression() = context and
   run.getStep().getJob().getWorkflow().getOn() = on and
   (
     exists(on.getNode("issues")) and

javascript/ql/src/change-notes/2022-05-03-actions-injection.md

@@ -0,0 +1,6 @@
+---
+category: newQuery
+---
+* The `js/actions/injection` query has been added. It highlights GitHub Actions workflows that may allow an 
+  attacker to execute arbitrary code in the workflow.
+  The query previously existed an experimental query.

javascript/ql/src/experimental/Security/CWE-094/UntrustedCheckout.ql

@@ -13,7 +13,7 @@
  */
 
 import javascript
-import experimental.semmle.javascript.Actions
+import semmle.javascript.Actions
 
 /**
  * An action step that doesn't contain `actor` or `label` check in `if:` or
@@ -78,7 +78,7 @@ class ProbableJob extends Actions::Job {
 /**
  * An action step that doesn't contain `actor` or `label` check in `if:` or
  */
-class ProbablePullRequestTarget extends Actions::On, Actions::MappingOrSequenceOrScalar {
+class ProbablePullRequestTarget extends Actions::On, YAMLMappingLikeNode {
   ProbablePullRequestTarget() {
     exists(YAMLNode prtNode |
       // The `on:` is triggered on `pull_request_target`
@@ -88,7 +88,7 @@ class ProbablePullRequestTarget extends Actions::On, Actions::MappingOrSequenceO
         not exists(prtNode.getAChild())
         or
         // or has the filter, that is something else than just [labeled]
-        exists(Actions::MappingOrSequenceOrScalar prt, Actions::MappingOrSequenceOrScalar types |
+        exists(YAMLMappingLikeNode prt, YAMLMappingLikeNode types |
           types = prt.getNode("types") and
           prtNode = prt and
           (

javascript/ql/src/experimental/semmle/javascript/Actions.qll

@@ -1,316 +1,4 @@
-/**
- * Libraries for modeling GitHub Actions workflow files written in YAML.
- * See https://docs.github.com/en/actions/reference/workflow-syntax-for-github-actions.
- */
-
-import javascript
-
-/**
- * Libraries for modeling GitHub Actions workflow files written in YAML.
- * See https://docs.github.com/en/actions/reference/workflow-syntax-for-github-actions.
- */
-module Actions {
-  /** A YAML node in a GitHub Actions workflow file. */
-  private class Node extends YAMLNode {
-    Node() {
-      this.getLocation()
-          .getFile()
-          .getRelativePath()
-          .matches(["experimental/Security/CWE-094/.github/workflows/%", ".github/workflows/%"])
-    }
-  }
-
-  /**
-   * Actions are quite flexible in parsing YAML.
-   *
-   * For example:
-   * ```
-   * on: pull_request
-   * ```
-   * and
-   * ```
-   * on: [pull_request]
-   * ```
-   * and
-   * ```
-   * on:
-   *   pull_request:
-   * ```
-   *
-   * are equivalent.
-   */
-  class MappingOrSequenceOrScalar extends YAMLNode {
-    MappingOrSequenceOrScalar() {
-      this instanceof YAMLMapping
-      or
-      this instanceof YAMLSequence
-      or
-      this instanceof YAMLScalar
-    }
-
-    YAMLNode getNode(string name) {
-      exists(YAMLMapping mapping |
-        mapping = this and
-        result = mapping.lookup(name)
-      )
-      or
-      exists(YAMLSequence sequence, YAMLNode node |
-        sequence = this and
-        sequence.getAChildNode() = node and
-        node.eval().toString() = name and
-        result = node
-      )
-      or
-      exists(YAMLScalar scalar |
-        scalar = this and
-        scalar.getValue() = name and
-        result = scalar
-      )
-    }
-
-    int getElementCount() {
-      exists(YAMLMapping mapping |
-        mapping = this and
-        result = mapping.getNumChild() / 2
-      )
-      or
-      exists(YAMLSequence sequence |
-        sequence = this and
-        result = sequence.getNumChild()
-      )
-      or
-      exists(YAMLScalar scalar |
-        scalar = this and
-        result = 1
-      )
-    }
-  }
-
-  /**
-   * An Actions workflow. This is a mapping at the top level of an Actions YAML workflow file.
-   * See https://docs.github.com/en/actions/reference/workflow-syntax-for-github-actions.
-   */
-  class Workflow extends Node, YAMLDocument, YAMLMapping {
-    /** Gets the `jobs` mapping from job IDs to job definitions in this workflow. */
-    YAMLMapping getJobs() { result = this.lookup("jobs") }
-
-    /** Gets the name of the workflow file. */
-    string getFileName() { result = this.getFile().getBaseName() }
-
-    /** Gets the `on:` in this workflow. */
-    On getOn() { result = this.lookup("on") }
-
-    /** Gets the job within this workflow with the given job ID. */
-    Job getJob(string jobId) { result.getWorkflow() = this and result.getId() = jobId }
-  }
-
-  /**
-   * An Actions On trigger within a workflow.
-   * See https://docs.github.com/en/actions/reference/workflow-syntax-for-github-actions#on.
-   */
-  class On extends YAMLNode, MappingOrSequenceOrScalar {
-    Workflow workflow;
-
-    On() { workflow.lookup("on") = this }
-
-    Workflow getWorkflow() { result = workflow }
-  }
-
-  /**
-   * An Actions job within a workflow.
-   * See https://docs.github.com/en/actions/reference/workflow-syntax-for-github-actions#jobs.
-   */
-  class Job extends YAMLNode, YAMLMapping {
-    string jobId;
-    Workflow workflow;
-
-    Job() { this = workflow.getJobs().lookup(jobId) }
-
-    /**
-     * Gets the ID of this job, as a string.
-     * This is the job's key within the `jobs` mapping.
-     */
-    string getId() { result = jobId }
-
-    /**
-     * Gets the ID of this job, as a YAML scalar node.
-     * This is the job's key within the `jobs` mapping.
-     */
-    YAMLString getIdNode() { workflow.getJobs().maps(result, this) }
-
-    /** Gets the human-readable name of this job, if any, as a string. */
-    string getName() { result = this.getNameNode().getValue() }
-
-    /** Gets the human-readable name of this job, if any, as a YAML scalar node. */
-    YAMLString getNameNode() { result = this.lookup("name") }
-
-    /** Gets the step at the given index within this job. */
-    Step getStep(int index) { result.getJob() = this and result.getIndex() = index }
-
-    /** Gets the sequence of `steps` within this job. */
-    YAMLSequence getSteps() { result = this.lookup("steps") }
-
-    /** Gets the workflow this job belongs to. */
-    Workflow getWorkflow() { result = workflow }
-
-    /** Gets the value of the `if` field in this job, if any. */
-    JobIf getIf() { result.getJob() = this }
-  }
-
-  /**
-   * An `if` within a job.
-   * See https://docs.github.com/en/actions/reference/workflow-syntax-for-github-actions#jobsjob_idif.
-   */
-  class JobIf extends YAMLNode, YAMLScalar {
-    Job job;
-
-    JobIf() { job.lookup("if") = this }
-
-    /** Gets the step this field belongs to. */
-    Job getJob() { result = job }
-  }
-
-  /**
-   * A step within an Actions job.
-   * See https://docs.github.com/en/actions/reference/workflow-syntax-for-github-actions#jobsjob_idsteps.
-   */
-  class Step extends YAMLNode, YAMLMapping {
-    int index;
-    Job job;
-
-    Step() { this = job.getSteps().getElement(index) }
-
-    /** Gets the 0-based position of this step within the sequence of `steps`. */
-    int getIndex() { result = index }
-
-    /** Gets the job this step belongs to. */
-    Job getJob() { result = job }
-
-    /** Gets the value of the `uses` field in this step, if any. */
-    Uses getUses() { result.getStep() = this }
-
-    /** Gets the value of the `run` field in this step, if any. */
-    Run getRun() { result.getStep() = this }
-
-    /** Gets the value of the `if` field in this step, if any. */
-    StepIf getIf() { result.getStep() = this }
-  }
-
-  /**
-   * An `if` within a step.
-   * See https://docs.github.com/en/actions/reference/workflow-syntax-for-github-actions#jobsjob_idstepsif.
-   */
-  class StepIf extends YAMLNode, YAMLScalar {
-    Step step;
-
-    StepIf() { step.lookup("if") = this }
-
-    /** Gets the step this field belongs to. */
-    Step getStep() { result = step }
-  }
-
-  /**
-   * A `uses` field within an Actions job step, which references an action as a reusable unit of code.
-   * See https://docs.github.com/en/actions/reference/workflow-syntax-for-github-actions#jobsjob_idstepsuses.
-   *
-   * For example:
-   * ```
-   * uses: actions/checkout@v2
-   * ```
-   * TODO: Does not currently handle local repository references, e.g. `.github/actions/action-name`.
-   */
-  class Uses extends YAMLNode, YAMLScalar {
-    Step step;
-    /** The owner of the repository where the Action comes from, e.g. `actions` in `actions/checkout@v2`. */
-    string repositoryOwner;
-    /** The name of the repository where the Action comes from, e.g. `checkout` in `actions/checkout@v2`. */
-    string repositoryName;
-    /** The version reference used when checking out the Action, e.g. `v2` in `actions/checkout@v2`. */
-    string version;
-
-    Uses() {
-      step.lookup("uses") = this and
-      // Simple regular expression to split up an Action reference `owner/repo@version` into its components.
-      exists(string regexp | regexp = "([^/]+)/([^/@]+)@(.+)" |
-        repositoryOwner = this.getValue().regexpCapture(regexp, 1) and
-        repositoryName = this.getValue().regexpCapture(regexp, 2) and
-        version = this.getValue().regexpCapture(regexp, 3)
-      )
-    }
-
-    /** Gets the step this field belongs to. */
-    Step getStep() { result = step }
-
-    /** Gets the owner and name of the repository where the Action comes from, e.g. `actions/checkout` in `actions/checkout@v2`. */
-    string getGitHubRepository() { result = repositoryOwner + "/" + repositoryName }
-
-    /** Gets the version reference used when checking out the Action, e.g. `v2` in `actions/checkout@v2`. */
-    string getVersion() { result = version }
-  }
-
-  /**
-   * A `with` field within an Actions job step, which references an action as a reusable unit of code.
-   * See https://docs.github.com/en/actions/reference/workflow-syntax-for-github-actions#jobsjob_idstepswith.
-   *
-   * For example:
-   * ```
-   * with:
-   *   arg1: 1
-   *   arg2: abc
-   * ```
-   */
-  class With extends YAMLNode, YAMLMapping {
-    Step step;
-
-    With() { step.lookup("with") = this }
-
-    /** Gets the step this field belongs to. */
-    Step getStep() { result = step }
-  }
-
-  /**
-   * A `ref:` field within an Actions `with:` specific to `actions/checkout` action.
-   *
-   * For example:
-   * ```
-   * uses: actions/checkout@v2
-   * with:
-   *   ref: ${{ github.event.pull_request.head.sha }}
-   * ```
-   */
-  class Ref extends YAMLNode, YAMLString {
-    With with;
-
-    Ref() { with.lookup("ref") = this }
-
-    With getWith() { result = with }
-  }
-
-  /**
-   * A `run` field within an Actions job step, which runs command-line programs using an operating system shell.
-   * See https://docs.github.com/en/free-pro-team@latest/actions/reference/workflow-syntax-for-github-actions#jobsjob_idstepsrun.
-   */
-  class Run extends YAMLNode, YAMLString {
-    Step step;
-
-    Run() { step.lookup("run") = this }
-
-    /** Gets the step that executes this `run` command. */
-    Step getStep() { result = step }
-
-    /**
-     * Holds if `${{ e }}` is a GitHub Actions expression evaluated within this `run` command.
-     * See https://docs.github.com/en/free-pro-team@latest/actions/reference/context-and-expression-syntax-for-github-actions.
-     */
-    string getAReferencedExpression() {
-      // We use `regexpFind` to obtain *all* matches of `${{...}}`,
-      // not just the last (greedy match) or first (reluctant match).
-      // TODO: This only handles expression strings that refer to contexts.
-      // It does not handle operators within the expression.
-      result =
-        this.getValue()
-            .regexpFind("\\$\\{\\{\\s*[A-Za-z0-9_\\.\\-]+\\s*\\}\\}", _, _)
-            .regexpCapture("\\$\\{\\{\\s*([A-Za-z0-9_\\.\\-]+)\\s*\\}\\}", 1)
-    }
-  }
+/** DEPRECATED: Use `semmle.javascript.Actions` instead. */
+deprecated module Actions {
+  import semmle.javascript.Actions::Actions
 }

javascript/ql/test/experimental/Security/CWE-094/ExpressionInjection.qlref

@@ -1 +0,0 @@
-experimental/Security/CWE-094/ExpressionInjection.ql

javascript/ql/test/query-tests/Security/CWE-094/ExpressionInjection/ExpressionInjection.qlref

@@ -0,0 +1 @@
+Security/CWE-094/ExpressionInjection.ql

javascript/ql/test/query-tests/Security/CWE-094/ExpressionInjection/empty.js

@@ -0,0 +1 @@
+console.log('test')

javascript/ql/test/query-tests/Security/CWE-915/PrototypePollutingAssignment/PrototypePollutingAssignment.expected

@@ -94,6 +94,12 @@ nodes
 | lib.js:108:3:108:10 | obj[one] |
 | lib.js:108:3:108:10 | obj[one] |
 | lib.js:108:7:108:9 | one |
+| sublib/sub.js:1:37:1:40 | path |
+| sublib/sub.js:1:37:1:40 | path |
+| sublib/sub.js:2:3:2:14 | obj[path[0]] |
+| sublib/sub.js:2:3:2:14 | obj[path[0]] |
+| sublib/sub.js:2:7:2:10 | path |
+| sublib/sub.js:2:7:2:13 | path[0] |
 | tst.js:5:9:5:38 | taint |
 | tst.js:5:17:5:38 | String( ... y.data) |
 | tst.js:5:24:5:37 | req.query.data |
@@ -230,6 +236,11 @@ edges
 | lib.js:104:13:104:24 | arguments[1] | lib.js:104:7:104:24 | one |
 | lib.js:108:7:108:9 | one | lib.js:108:3:108:10 | obj[one] |
 | lib.js:108:7:108:9 | one | lib.js:108:3:108:10 | obj[one] |
+| sublib/sub.js:1:37:1:40 | path | sublib/sub.js:2:7:2:10 | path |
+| sublib/sub.js:1:37:1:40 | path | sublib/sub.js:2:7:2:10 | path |
+| sublib/sub.js:2:7:2:10 | path | sublib/sub.js:2:7:2:13 | path[0] |
+| sublib/sub.js:2:7:2:13 | path[0] | sublib/sub.js:2:3:2:14 | obj[path[0]] |
+| sublib/sub.js:2:7:2:13 | path[0] | sublib/sub.js:2:3:2:14 | obj[path[0]] |
 | tst.js:5:9:5:38 | taint | tst.js:8:12:8:16 | taint |
 | tst.js:5:9:5:38 | taint | tst.js:9:12:9:16 | taint |
 | tst.js:5:9:5:38 | taint | tst.js:12:25:12:29 | taint |
@@ -284,6 +295,7 @@ edges
 | lib.js:70:13:70:24 | obj[path[0]] | lib.js:59:18:59:18 | s | lib.js:70:13:70:24 | obj[path[0]] | This assignment may alter Object.prototype if a malicious '__proto__' string is injected from $@. | lib.js:59:18:59:18 | s | library input |
 | lib.js:87:10:87:14 | proto | lib.js:83:14:83:25 | arguments[1] | lib.js:87:10:87:14 | proto | This assignment may alter Object.prototype if a malicious '__proto__' string is injected from $@. | lib.js:83:14:83:25 | arguments[1] | library input |
 | lib.js:108:3:108:10 | obj[one] | lib.js:104:13:104:24 | arguments[1] | lib.js:108:3:108:10 | obj[one] | This assignment may alter Object.prototype if a malicious '__proto__' string is injected from $@. | lib.js:104:13:104:24 | arguments[1] | library input |
+| sublib/sub.js:2:3:2:14 | obj[path[0]] | sublib/sub.js:1:37:1:40 | path | sublib/sub.js:2:3:2:14 | obj[path[0]] | This assignment may alter Object.prototype if a malicious '__proto__' string is injected from $@. | sublib/sub.js:1:37:1:40 | path | library input |
 | tst.js:8:5:8:17 | object[taint] | tst.js:5:24:5:37 | req.query.data | tst.js:8:5:8:17 | object[taint] | This assignment may alter Object.prototype if a malicious '__proto__' string is injected from $@. | tst.js:5:24:5:37 | req.query.data | user controlled input |
 | tst.js:9:5:9:17 | object[taint] | tst.js:5:24:5:37 | req.query.data | tst.js:9:5:9:17 | object[taint] | This assignment may alter Object.prototype if a malicious '__proto__' string is injected from $@. | tst.js:5:24:5:37 | req.query.data | user controlled input |
 | tst.js:14:5:14:32 | unsafeG ...  taint) | tst.js:5:24:5:37 | req.query.data | tst.js:14:5:14:32 | unsafeG ...  taint) | This assignment may alter Object.prototype if a malicious '__proto__' string is injected from $@. | tst.js:5:24:5:37 | req.query.data | user controlled input |

javascript/ql/test/query-tests/Security/CWE-915/PrototypePollutingAssignment/sublib/package.json

@@ -0,0 +1,4 @@
+{
+    "name": "sublib",
+    "main": "./sub"
+}

javascript/ql/test/query-tests/Security/CWE-915/PrototypePollutingAssignment/sublib/sub.js

@@ -0,0 +1,3 @@
+module.exports.set = function (obj, path, value) {
+  obj[path[0]][path[1]] = value; // NOT OK
+}

javascript/ql/test/query-tests/Security/CWE-915/PrototypePollutingAssignment/sublib/sub/empty.js

@@ -0,0 +1 @@
+console.log("foo");