hohn/codeql
1
0
Fork 0
mirror of https://github.com/github/codeql.git synced 2026-04-22 23:35:14 +02:00
Code Issues Packages Projects Releases Wiki Activity

Exclude artifacts downloaded to runner temp.

Browse Source
This commit is contained in:
Adnan Khan
2025-04-25 14:49:01 -04:00
committed by GitHub
parent 987af4ce1d
commit 38f00775bd
1 changed files with 2 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files

3
actions/ql/lib/codeql/actions/security/ArtifactPoisoningQuery.qll
View File

@@ -262,8 +262,9 @@ class ArtifactPoisoningSink extends DataFlow::Node {
ArtifactPoisoningSink() {
download.getAFollowingStep() = poisonable and
// excluding artifacts downloaded to /tmp
// excluding artifacts downloaded to /tmp and runner.tmp
not download.getPath().regexpMatch("^/tmp.*") and
not download.getPath().regexpMatch("^\${{\s?runner.temp\s?}}.*") and
(
poisonable.(Run).getScript() = this.asExpr() and
(