hohn/codeql
1
0
Fork 0
mirror of https://github.com/github/codeql.git synced 2025-12-16 16:53:25 +01:00
Code Issues Packages Projects Releases Wiki Activity

Pull out logic into separate predicate

Browse Source
This commit is contained in:
Owen Mansel-Chan
2025-12-03 12:59:35 +00:00
parent fb841ea591
commit 4a16de2bc8
1 changed files with 12 additions and 10 deletions
Download Patch File Download Diff File Expand all files Collapse all files

22
actions/ql/lib/codeql/actions/security/CodeInjectionQuery.qll
View File

@@ -19,12 +19,7 @@ class CodeInjectionSink extends DataFlow::Node {
Event getRelevantCriticalEventForSink(DataFlow::Node sink) { Event getRelevantCriticalEventForSink(DataFlow::Node sink) {
inPrivilegedContext(sink.asExpr(), result) and inPrivilegedContext(sink.asExpr(), result) and
not exists(ControlCheck check | check.protects(sink.asExpr(), result, "code-injection")) and not exists(ControlCheck check | check.protects(sink.asExpr(), result, "code-injection")) and
// exclude cases where the sink is a JS script and the expression uses toJson not isGithubScriptUsingToJson(sink.asExpr())
not exists(UsesStep script |
script.getCallee() = "actions/github-script" and
script.getArgumentExpr("script") = sink.asExpr() and
exists(getAToJsonReferenceExpression(sink.asExpr().(Expression).getExpression(), _))
)
} }
/** /**
@@ -112,10 +107,17 @@ predicate mediumSeverityCodeInjection(
) { ) {
CodeInjectionFlow::flowPath(source, sink) and CodeInjectionFlow::flowPath(source, sink) and
not criticalSeverityCodeInjection(source, sink, _) and not criticalSeverityCodeInjection(source, sink, _) and
// exclude cases where the sink is a JS script and the expression uses toJson not isGithubScriptUsingToJson(sink.getNode().asExpr())
not exists(UsesStep script | }
/**
* Holds if `expr` is the `script` input to `actions/github-script` and it uses
* `toJson`.
*/
predicate isGithubScriptUsingToJson(Expression expr) {
exists(UsesStep script |
script.getCallee() = "actions/github-script" and script.getCallee() = "actions/github-script" and
script.getArgumentExpr("script") = sink.getNode().asExpr() and script.getArgumentExpr("script") = expr and
exists(getAToJsonReferenceExpression(sink.getNode().asExpr().(Expression).getExpression(), _)) exists(getAToJsonReferenceExpression(expr.getExpression(), _))
) )
} }