hohn/codeql
1
0
Fork 0
mirror of https://github.com/github/codeql.git synced 2026-05-02 12:15:17 +02:00
Code Issues Packages Projects Releases Wiki Activity

Improve privilege workflow detection

Browse Source
This commit is contained in:
Alvaro Muñoz
2024-09-24 12:12:29 +02:00
parent fe06c9e5fa
commit abd49d5b11
1 changed files with 0 additions and 16 deletions
Download Patch File Download Diff File Expand all files Collapse all files

16
ql/lib/codeql/actions/Helper.qll
View File

@@ -252,26 +252,10 @@ predicate inPrivilegedExternallyTriggerableJob(AstNode node) {
)
}
predicate calledByPrivilegedExternallyTriggerableJob(AstNode node) {
exists(ReusableWorkflow rw, ExternalJob caller, Job callee |
callee = node.getEnclosingJob() and
rw.getACaller() = caller and
rw.getAJob() = callee and
caller.isPrivilegedExternallyTriggerable()
)
or
exists(LocalJob caller |
caller = node.getEnclosingCompositeAction().getACallerJob() and
caller.isPrivilegedExternallyTriggerable()
)
}
predicate inPrivilegedContext(AstNode node) {
inPrivilegedCompositeAction(node)
or
inPrivilegedExternallyTriggerableJob(node)
or
calledByPrivilegedExternallyTriggerableJob(node)
}
predicate inNonPrivilegedCompositeAction(AstNode node) {