hohn/codeql
1
0
Fork 0
mirror of https://github.com/github/codeql.git synced 2026-01-08 20:20:34 +01:00
Code Issues Packages Projects Releases Wiki Activity

Refactor regexps

Browse Source
This commit is contained in:
Alvaro Muñoz
2024-05-13 13:47:01 +02:00
parent 9ee9314cb9
commit a1efc78ac7
1 changed files with 17 additions and 6 deletions
Download Patch File Download Diff File Expand all files Collapse all files

23
ql/lib/codeql/actions/security/SelfHostedQuery.qll
View File

@@ -1,10 +1,17 @@
import actions
import codeql.actions.dataflow.ExternalFlow
string selfHostedRunnerRegexp() {
// source: https://github.com/boostsecurityio/poutine/blob/main/opa/rego/poutine/utils.rego#L49C3-L49C136
result =
"(?i)^((ubuntu-(([0-9]{2})\\.04|latest)|macos-([0-9]{2}|latest)(-x?large)?|windows-(20[0-9]{2}|latest)|(buildjet|warp)-[a-z0-9-]+))$"
bindingset[runner]
predicate isGithubHostedRunner(string runner) {
// list of github hosted repos: https://github.com/actions/runner-images/blob/main/README.md#available-images
runner
.toLowerCase()
.regexpMatch("^(ubuntu-([0-9.]+|latest)|macos-([0-9]+|latest)(-x?large)?|windows-([0-9.]+|latest)|(buildjet|warp)-[a-z0-9-]+)$")
}
bindingset[runner]
predicate is3rdPartyHostedRunner(string runner) {
runner.toLowerCase().regexpMatch("^(buildjet|warp)-[a-z0-9-]+$")
}
/**
@@ -15,9 +22,13 @@ string selfHostedRunnerRegexp() {
predicate staticallyIdentifiedSelfHostedRunner(Job job) {
exists(string label |
job.getATriggerEvent().getName() =
["pull_request", "pull_request_review", "pull_request_review_comment", "pull_request_target"] and
[
"issue_comment", "pull_request", "pull_request_review", "pull_request_review_comment",
"pull_request_target", "workflow_run"
] and
label = job.getARunsOnLabel() and
not label.regexpMatch(selfHostedRunnerRegexp())
not isGithubHostedRunner(label) and
not is3rdPartyHostedRunner(label)
)
}