hohn/codeql
1
0
Fork 0
mirror of https://github.com/github/codeql.git synced 2025-12-17 01:03:14 +01:00
Code Issues Packages Projects Releases Wiki Activity

Handle multiple whitespaces in runner temp regex.

Browse Source 
Co-authored-by: Napalys Klicius <napalys@github.com>
This commit is contained in:
Adnan Khan
2025-07-10 12:22:14 -04:00
committed by GitHub
parent e40e4c3856
commit 7be938c6c3
1 changed files with 1 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files

2
actions/ql/lib/codeql/actions/security/ArtifactPoisoningQuery.qll
View File

@@ -264,7 +264,7 @@ class ArtifactPoisoningSink extends DataFlow::Node {
download.getAFollowingStep() = poisonable and
// excluding artifacts downloaded to the temporary directory
not download.getPath().regexpMatch("^/tmp.*") and
not download.getPath().regexpMatch("^\\$\\{\\{\\s?runner\\.temp\\s?}}.*") and
not download.getPath().regexpMatch("^\\$\\{\\{\\s*runner\\.temp\\s*}}.*") and
not download.getPath().regexpMatch("^\\$RUNNER_TEMP.*") and
(
poisonable.(Run).getScript() = this.asExpr() and