hohn/codeql
1
0
Fork 0
mirror of https://github.com/github/codeql.git synced 2026-01-08 04:00:26 +01:00
Code Issues Packages Projects Releases Wiki Activity

Fix tests

Browse Source
This commit is contained in:
Jaroslav Lobačevski
2024-05-15 15:27:59 +00:00
parent 1a4939a13b
commit 11edff936b
1 changed files with 36 additions and 27 deletions
Download Patch File Download Diff File Expand all files Collapse all files

63
ql/lib/codeql/actions/security/CachePoisoningQuery.qll
View File

@@ -11,39 +11,48 @@ string defaultBranchTriggerEvent() {
]
}
string defaultBranchNames() {
exists(string default_branch_name |
repositoryDataModel(_, default_branch_name) and
result = default_branch_name
)
or
not exist(string default_branch_name |
repositoryDataModel(_, default_branch_name) and
result = ["main", "master"]
)
}
predicate runsOnDefaultBranch(Job j) {
exists(Event e |
j.getATriggerEvent() = e and
exists(string default_branch_name |
repositoryDataModel(_, default_branch_name) and
(
e.getName() = defaultBranchTriggerEvent() and
not e.getName() = "pull_request_target"
or
e.getName() = "push" and
e.getAPropertyValue("branches") = defaultBranchNames()
or
e.getName() = "pull_request_target" and
(
e.getName() = defaultBranchTriggerEvent() and
not e.getName() = "pull_request_target"
// no filtering
not e.hasProperty("branches") and not e.hasProperty("branches-ignore")
or
e.getName() = "push" and
e.getAPropertyValue("branches") = default_branch_name
// only branches-ignore filter
e.hasProperty("branches-ignore") and
not e.hasProperty("branches") and
not e.getAPropertyValue("branches-ignore") = defaultBranchNames()
or
e.getName() = "pull_request_target" and
(
// no filtering
not e.hasProperty("branches") and not e.hasProperty("branches-ignore")
or
// only branches-ignore filter
e.hasProperty("branches-ignore") and
not e.hasProperty("branches") and
not e.getAPropertyValue("branches-ignore") = default_branch_name
or
// only branches filter
e.hasProperty("branches") and
not e.hasProperty("branches-ignore") and
e.getAPropertyValue("branches") = default_branch_name
or
// branches and branches-ignore filters
e.hasProperty("branches") and
e.hasProperty("branches-ignore") and
e.getAPropertyValue("branches") = default_branch_name and
not e.getAPropertyValue("branches-ignore") = default_branch_name
)
// only branches filter
e.hasProperty("branches") and
not e.hasProperty("branches-ignore") and
e.getAPropertyValue("branches") = defaultBranchNames()
or
// branches and branches-ignore filters
e.hasProperty("branches") and
e.hasProperty("branches-ignore") and
e.getAPropertyValue("branches") = defaultBranchNames() and
not e.getAPropertyValue("branches-ignore") = defaultBranchNames()
)
)
)