hohn/codeql
1
0
Fork 0
mirror of https://github.com/github/codeql.git synced 2026-05-03 04:39:29 +02:00
Code Issues Packages Projects Releases Wiki Activity

feat(sources): Do not take triggers into consideration

Browse Source
This commit is contained in:
Alvaro Muñoz
2024-03-22 13:32:29 +01:00
parent 9d5b026fde
commit 2ed3aceddf
24 changed files with 123 additions and 138 deletions
Download Patch File Download Diff File Expand all files Collapse all files

10
ql/src/Security/CWE-078/PrivilegedCommandInjection.ql
View File

@@ -16,14 +16,16 @@ import actions
import codeql.actions.security.CommandInjectionQuery
import CommandInjectionFlow::PathGraph
predicate isSingleTriggerWorkflow(Workflow w, string trigger) {
w.getATriggerEvent() = trigger and
count(string t | w.getATriggerEvent() = t | t) = 1
}
from CommandInjectionFlow::PathNode source, CommandInjectionFlow::PathNode sink, Workflow w
where
CommandInjectionFlow::flowPath(source, sink) and
w = source.getNode().asExpr().getEnclosingWorkflow() and
(
w instanceof ReusableWorkflow or
w.hasTriggerEvent(source.getNode().(RemoteFlowSource).getATriggerEvent())
)
not isSingleTriggerWorkflow(w, "pull_request")
select sink.getNode(), source, sink,
"Potential privileged command injection in $@, which may be controlled by an external user.",
sink, sink.getNode().asExpr().(Expression).getRawExpression()

10
ql/src/Security/CWE-094/PrivilegedCodeInjection.ql
View File

@@ -18,14 +18,16 @@ import actions
import codeql.actions.security.CodeInjectionQuery
import CodeInjectionFlow::PathGraph
predicate isSingleTriggerWorkflow(Workflow w, string trigger) {
w.getATriggerEvent() = trigger and
count(string t | w.getATriggerEvent() = t | t) = 1
}
from CodeInjectionFlow::PathNode source, CodeInjectionFlow::PathNode sink, Workflow w
where
CodeInjectionFlow::flowPath(source, sink) and
w = source.getNode().asExpr().getEnclosingWorkflow() and
(
w instanceof ReusableWorkflow or
w.hasTriggerEvent(source.getNode().(RemoteFlowSource).getATriggerEvent())
)
not isSingleTriggerWorkflow(w, "pull_request")
select sink.getNode(), source, sink,
"Potential privileged code injection in $@, which may be controlled by an external user.", sink,
sink.getNode().asExpr().(Expression).getRawExpression()