hohn/codeql
1
0
Fork 0
mirror of https://github.com/github/codeql.git synced 2026-04-30 19:26:02 +02:00
Code Issues Packages Projects Releases Wiki Activity

Apply suggestions from code review

Browse Source 
Co-authored-by: Erik Krogh Kristensen <erik-krogh@github.com>
This commit is contained in:
Jaroslav Lobačevski
2021-03-15 18:14:20 +02:00
committed by GitHub
parent 673e64909a
commit 16ca2314e4
3 changed files with 5 additions and 5 deletions
Download Patch File Download Diff File Expand all files Collapse all files

2
javascript/ql/src/experimental/Security/CWE-829/expression_injection.ql
View File

@@ -1,5 +1,5 @@
/**
* @name Injection from user-controlled Actions context
* @name Expression injection in Actions
* @description Using user-controlled GitHub Actions contexts like `run:` or `script:` may allow a malicious
* user to inject code into the GitHub action.
* @kind problem

6
javascript/ql/src/experimental/Security/CWE-829/pull_request_target.ql
View File

@@ -1,6 +1,6 @@
/**
* @name pull_request_target with explicit pull request checkout
* @description Workflows triggered on `pull_request_target` have read/write tokens for the base repository and the access to secrets.
* @name Checkout of untrusted code in trusted context
* @description Workflows triggered on `pull_request_target` have read/write access to the base repository and access to secrets.
* By explicitly checking out and running the build script from a fork the untrusted code is running in an environment
* that is able to push to the base repository and to access secrets.
* @kind problem
@@ -119,4 +119,4 @@ where
) and
step instanceof ProbableStep and
job instanceof ProbableJob
select step, "Potential unsafe checkout of untrusted pull request on `pull_request_target`"
select step, "Potential unsafe checkout of untrusted pull request on `pull_request_target`"

2
javascript/ql/src/experimental/semmle/javascript/Actions.qll
View File

@@ -12,7 +12,7 @@ import javascript
module Actions {
/** A YAML node in a GitHub Actions workflow file. */
private class Node extends YAMLNode {
Node() { this.getLocation().getFile().getRelativePath().matches(".github/workflows/%") }
Node() { this.getLocation().getFile().getRelativePath().matches(["experimental/Security/CWE-829/.github/workflows/%", ".github/workflows/%"]) }
}
/**