hohn/codeql
1
0
Fork 0
mirror of https://github.com/github/codeql.git synced 2025-12-28 06:36:33 +01:00
Code Issues Packages Projects Releases Wiki Activity

Fix ImproperAccess query

Browse Source
This commit is contained in:
Alvaro Muñoz
2024-08-09 17:17:18 +02:00
parent 9411fac4d0
commit 569e80b678
2 changed files with 10 additions and 5 deletions
Download Patch File Download Diff File Expand all files Collapse all files

13
ql/src/Security/CWE-285/ImproperAccessControl.ql
View File

@@ -17,9 +17,14 @@ import codeql.actions.security.ControlChecks
from LocalJob job, LabelCheck check, MutableRefCheckoutStep checkout, Event event
where
job.isPrivileged() and
job.getATriggerEvent() = event and
event.getName() = "pull_request_target" and
event.getAnActivityType() = "synchronize" and
check.dominates(checkout)
job.getAStep() = checkout and
check.dominates(checkout) and
(
job.getATriggerEvent() = event and
event.getName() = "pull_request_target" and
event.getAnActivityType() = "synchronize"
or
not exists(job.getATriggerEvent())
)
select checkout, "The checked-out code can be modified after the authorization check $@.", check,
check.toString()

2
ql/test/query-tests/Security/CWE-285/ImproperAccessControl.expected
View File

@@ -1 +1 @@
| .github/workflows/test1.yml:15:7:20:4 | Uses Step | The checked-out code can be changed after the authorization check o step $@. | .github/workflows/test1.yml:17:11:17:75 | contain ... test') | contain ... test') |
| .github/workflows/test1.yml:15:7:20:4 | Uses Step | The checked-out code can be modified after the authorization check $@. | .github/workflows/test1.yml:17:11:17:75 | contain ... test') | contain ... test') |