hohn/codeql
1
0
Fork 0
mirror of https://github.com/github/codeql.git synced 2026-01-05 02:30:19 +01:00
Code Issues Packages Projects Releases Wiki Activity

Improve poisonable steps

Browse Source
This commit is contained in:
Alvaro Muñoz
2024-07-05 18:16:50 +02:00
parent 966a9b1652
commit e5064f8090
9 changed files with 376 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files

4
ql/lib/codeql/actions/security/PoisonableSteps.qll
View File

@@ -30,7 +30,9 @@ class LocalScriptExecutionRunStep extends PoisonableStep, Run {
exists(string line, string regexp, int group | line = this.getScript().splitAt("\n").trim() |
poisonableLocalScriptsDataModel(regexp, group) and
//cmd = line.regexpCapture(".*(^|\\b|\\s+|\\$\\(|`)" + regexp + "(\\b|\\s+|;|\\)|`|$).*", group)
cmd = line.regexpCapture(".*(^|;|\\$\\(|`|\\|)\\s*" + regexp + "\\s*(;|\\||\\)|`|$).*", group)
cmd =
line.regexpCapture(".*(^|;|\\$\\(|`|\\||&&)\\s*" + regexp + "\\s*(;|\\||\\)|`|-|&&|$).*",
group)
)
}

1
ql/lib/ext/config/poisonable_steps.yml
View File

@@ -58,6 +58,7 @@ extensions:
data:
# TODO: It could also be in the form of `dir/cmd`
- ["(\\.\\/)(.*)", 3]
- ["(\\.\\s+)(.*)", 3] # eg: . venv/bin/activate
- ["(source|sh|bash|zsh|fish)\\s+(.*)", 3]
- ["(node)\\s+(.*)(\\.js|\\.ts)", 3]
- ["(python)\\s+(.*)\\.py", 3]

25
ql/test/library-tests/.github/workflows/poisonable_steps.yml vendored Normal file
View File

@@ -0,0 +1,25 @@
on: push
jobs:
local_commands:
runs-on: ubuntu-latest
steps:
- run: venv/bin/activate # not supported yet
- run: . venv/bin/activate
- run: echo foo; . venv/bin/activate
- run: echo foo;. venv/bin/activate
- run: echo foo |. venv/bin/activate
- run: ./venv/bin/activate
- run: sh venv/bin/activate.sh
- run: echo $(sh venv/bin/activate.sh)
- run: echo foo; sh venv/bin/activate.sh; echo bar
- run: echo foo | sh venv/bin/activate.sh > output
- run: python venv/bin/activate.py
- run: echo foo; python venv/bin/activate.py
- run: pnpm run test:ct
- run: pip install nbformat && python scripts/generate_notebooks.py
- run: python scripts/generate_theme.py --outfile js/storybook/theme.css
- run: ruby scripts/generate_theme.rb --outfile js/storybook/theme.css
- run: bundle run exec ruby scripts/generate_theme.rb --outfile js/storybook/theme.css

18
ql/test/library-tests/poisonable_steps.expected Normal file
View File

@@ -0,0 +1,18 @@
| .github/workflows/multiline.yml:24:9:30:6 | Run Step |
| .github/workflows/multiline.yml:63:9:66:6 | Run Step |
| .github/workflows/poisonable_steps.yml:8:9:9:6 | Run Step |
| .github/workflows/poisonable_steps.yml:9:9:10:6 | Run Step |
| .github/workflows/poisonable_steps.yml:10:9:11:6 | Run Step |
| .github/workflows/poisonable_steps.yml:11:9:12:6 | Run Step |
| .github/workflows/poisonable_steps.yml:12:9:13:6 | Run Step |
| .github/workflows/poisonable_steps.yml:13:9:14:6 | Run Step |
| .github/workflows/poisonable_steps.yml:14:9:15:6 | Run Step |
| .github/workflows/poisonable_steps.yml:15:9:16:6 | Run Step |
| .github/workflows/poisonable_steps.yml:16:9:17:6 | Run Step |
| .github/workflows/poisonable_steps.yml:17:9:18:6 | Run Step |
| .github/workflows/poisonable_steps.yml:18:9:19:6 | Run Step |
| .github/workflows/poisonable_steps.yml:19:9:20:6 | Run Step |
| .github/workflows/poisonable_steps.yml:20:9:21:6 | Run Step |
| .github/workflows/poisonable_steps.yml:21:9:22:6 | Run Step |
| .github/workflows/poisonable_steps.yml:22:9:23:6 | Run Step |
| .github/workflows/poisonable_steps.yml:23:9:23:93 | Run Step |

5
ql/test/library-tests/poisonable_steps.ql Normal file
View File

@@ -0,0 +1,5 @@
import actions
import codeql.actions.security.PoisonableSteps
from PoisonableStep step
select step

241
ql/test/library-tests/test.expected
View File

@@ -1,21 +1,25 @@
files
| .github/workflows/expression_nodes.yml:0:0:0:0 | .github/workflows/expression_nodes.yml |
| .github/workflows/multiline.yml:0:0:0:0 | .github/workflows/multiline.yml |
| .github/workflows/poisonable_steps.yml:0:0:0:0 | .github/workflows/poisonable_steps.yml |
| .github/workflows/test.yml:0:0:0:0 | .github/workflows/test.yml |
workflows
| .github/workflows/expression_nodes.yml:1:1:21:47 | on: issue_comment |
| .github/workflows/multiline.yml:1:1:89:29 | on: |
| .github/workflows/poisonable_steps.yml:1:1:23:93 | on: push |
| .github/workflows/test.yml:1:1:40:53 | on: push |
reusableWorkflows
compositeActions
jobs
| .github/workflows/expression_nodes.yml:5:5:21:47 | Job: echo-chamber |
| .github/workflows/multiline.yml:9:5:89:29 | Job: Test |
| .github/workflows/poisonable_steps.yml:5:5:23:93 | Job: local_commands |
| .github/workflows/test.yml:5:5:31:2 | Job: job1 |
| .github/workflows/test.yml:32:5:40:53 | Job: job2 |
localJobs
| .github/workflows/expression_nodes.yml:5:5:21:47 | Job: echo-chamber |
| .github/workflows/multiline.yml:9:5:89:29 | Job: Test |
| .github/workflows/poisonable_steps.yml:5:5:23:93 | Job: local_commands |
| .github/workflows/test.yml:5:5:31:2 | Job: job1 |
| .github/workflows/test.yml:32:5:40:53 | Job: job2 |
extJobs
@@ -41,6 +45,23 @@ steps
| .github/workflows/multiline.yml:71:9:78:6 | Run Step |
| .github/workflows/multiline.yml:78:9:85:6 | Run Step |
| .github/workflows/multiline.yml:85:9:89:29 | Run Step |
| .github/workflows/poisonable_steps.yml:7:9:8:6 | Run Step |
| .github/workflows/poisonable_steps.yml:8:9:9:6 | Run Step |
| .github/workflows/poisonable_steps.yml:9:9:10:6 | Run Step |
| .github/workflows/poisonable_steps.yml:10:9:11:6 | Run Step |
| .github/workflows/poisonable_steps.yml:11:9:12:6 | Run Step |
| .github/workflows/poisonable_steps.yml:12:9:13:6 | Run Step |
| .github/workflows/poisonable_steps.yml:13:9:14:6 | Run Step |
| .github/workflows/poisonable_steps.yml:14:9:15:6 | Run Step |
| .github/workflows/poisonable_steps.yml:15:9:16:6 | Run Step |
| .github/workflows/poisonable_steps.yml:16:9:17:6 | Run Step |
| .github/workflows/poisonable_steps.yml:17:9:18:6 | Run Step |
| .github/workflows/poisonable_steps.yml:18:9:19:6 | Run Step |
| .github/workflows/poisonable_steps.yml:19:9:20:6 | Run Step |
| .github/workflows/poisonable_steps.yml:20:9:21:6 | Run Step |
| .github/workflows/poisonable_steps.yml:21:9:22:6 | Run Step |
| .github/workflows/poisonable_steps.yml:22:9:23:6 | Run Step |
| .github/workflows/poisonable_steps.yml:23:9:23:93 | Run Step |
| .github/workflows/test.yml:11:9:15:6 | Uses Step |
| .github/workflows/test.yml:15:9:19:6 | Uses Step: source |
| .github/workflows/test.yml:19:9:26:6 | Uses Step: step |
@@ -69,6 +90,23 @@ runSteps
| .github/workflows/multiline.yml:71:9:78:6 | Run Step | {\n echo 'JSON_RESPONSE<<EOF'\n echo "$TITLE"\n echo EOF\n} >> "$GITHUB_ENV"\n |
| .github/workflows/multiline.yml:78:9:85:6 | Run Step | {\n echo 'JSON_RESPONSE<<EOF'\n echo '$ISSUE'\n echo 'EOF'\n} >> "$GITHUB_ENV"\n |
| .github/workflows/multiline.yml:85:9:89:29 | Run Step | {\n echo 'JSON_RESPONSE<<EOF'\n} >> "$GITHUB_ENV"\n |
| .github/workflows/poisonable_steps.yml:7:9:8:6 | Run Step | venv/bin/activate |
| .github/workflows/poisonable_steps.yml:8:9:9:6 | Run Step | . venv/bin/activate |
| .github/workflows/poisonable_steps.yml:9:9:10:6 | Run Step | echo foo; . venv/bin/activate |
| .github/workflows/poisonable_steps.yml:10:9:11:6 | Run Step | echo foo;. venv/bin/activate |
| .github/workflows/poisonable_steps.yml:11:9:12:6 | Run Step | echo foo \|. venv/bin/activate |
| .github/workflows/poisonable_steps.yml:12:9:13:6 | Run Step | ./venv/bin/activate |
| .github/workflows/poisonable_steps.yml:13:9:14:6 | Run Step | sh venv/bin/activate.sh |
| .github/workflows/poisonable_steps.yml:14:9:15:6 | Run Step | echo $(sh venv/bin/activate.sh) |
| .github/workflows/poisonable_steps.yml:15:9:16:6 | Run Step | echo foo; sh venv/bin/activate.sh; echo bar |
| .github/workflows/poisonable_steps.yml:16:9:17:6 | Run Step | echo foo \| sh venv/bin/activate.sh > output |
| .github/workflows/poisonable_steps.yml:17:9:18:6 | Run Step | python venv/bin/activate.py |
| .github/workflows/poisonable_steps.yml:18:9:19:6 | Run Step | echo foo; python venv/bin/activate.py |
| .github/workflows/poisonable_steps.yml:19:9:20:6 | Run Step | pnpm run test:ct |
| .github/workflows/poisonable_steps.yml:20:9:21:6 | Run Step | pip install nbformat && python scripts/generate_notebooks.py |
| .github/workflows/poisonable_steps.yml:21:9:22:6 | Run Step | python scripts/generate_theme.py --outfile js/storybook/theme.css |
| .github/workflows/poisonable_steps.yml:22:9:23:6 | Run Step | ruby scripts/generate_theme.rb --outfile js/storybook/theme.css |
| .github/workflows/poisonable_steps.yml:23:9:23:93 | Run Step | bundle run exec ruby scripts/generate_theme.rb --outfile js/storybook/theme.css |
| .github/workflows/test.yml:26:9:28:6 | Run Step: simplesink1 | echo ${{ steps.source.outputs.all_changed_files }} |
| .github/workflows/test.yml:28:9:31:2 | Run Step: simplesink2 | ${{ github.event.pull_request.head.ref }} |
| .github/workflows/test.yml:39:9:40:53 | Run Step: sink | echo ${{needs.job1.outputs.job_output}} |
@@ -130,6 +168,23 @@ runStepChildren
| .github/workflows/multiline.yml:78:9:85:6 | Run Step | .github/workflows/multiline.yml:79:14:84:29 | {\n echo 'JSON_RESPONSE<<EOF'\n echo '$ISSUE'\n echo 'EOF'\n} >> "$GITHUB_ENV"\n |
| .github/workflows/multiline.yml:85:9:89:29 | Run Step | .github/workflows/multiline.yml:85:15:85:21 | block13 |
| .github/workflows/multiline.yml:85:9:89:29 | Run Step | .github/workflows/multiline.yml:86:14:89:29 | {\n echo 'JSON_RESPONSE<<EOF'\n} >> "$GITHUB_ENV"\n |
| .github/workflows/poisonable_steps.yml:7:9:8:6 | Run Step | .github/workflows/poisonable_steps.yml:7:14:7:30 | venv/bin/activate |
| .github/workflows/poisonable_steps.yml:8:9:9:6 | Run Step | .github/workflows/poisonable_steps.yml:8:14:8:32 | . venv/bin/activate |
| .github/workflows/poisonable_steps.yml:9:9:10:6 | Run Step | .github/workflows/poisonable_steps.yml:9:14:9:42 | echo foo; . venv/bin/activate |
| .github/workflows/poisonable_steps.yml:10:9:11:6 | Run Step | .github/workflows/poisonable_steps.yml:10:14:10:41 | echo foo;. venv/bin/activate |
| .github/workflows/poisonable_steps.yml:11:9:12:6 | Run Step | .github/workflows/poisonable_steps.yml:11:14:11:42 | echo foo \|. venv/bin/activate |
| .github/workflows/poisonable_steps.yml:12:9:13:6 | Run Step | .github/workflows/poisonable_steps.yml:12:14:12:32 | ./venv/bin/activate |
| .github/workflows/poisonable_steps.yml:13:9:14:6 | Run Step | .github/workflows/poisonable_steps.yml:13:14:13:36 | sh venv/bin/activate.sh |
| .github/workflows/poisonable_steps.yml:14:9:15:6 | Run Step | .github/workflows/poisonable_steps.yml:14:14:14:44 | echo $(sh venv/bin/activate.sh) |
| .github/workflows/poisonable_steps.yml:15:9:16:6 | Run Step | .github/workflows/poisonable_steps.yml:15:14:15:56 | echo foo; sh venv/bin/activate.sh; echo bar |
| .github/workflows/poisonable_steps.yml:16:9:17:6 | Run Step | .github/workflows/poisonable_steps.yml:16:14:16:56 | echo foo \| sh venv/bin/activate.sh > output |
| .github/workflows/poisonable_steps.yml:17:9:18:6 | Run Step | .github/workflows/poisonable_steps.yml:17:14:17:40 | python venv/bin/activate.py |
| .github/workflows/poisonable_steps.yml:18:9:19:6 | Run Step | .github/workflows/poisonable_steps.yml:18:14:18:50 | echo foo; python venv/bin/activate.py |
| .github/workflows/poisonable_steps.yml:19:9:20:6 | Run Step | .github/workflows/poisonable_steps.yml:19:14:19:29 | pnpm run test:ct |
| .github/workflows/poisonable_steps.yml:20:9:21:6 | Run Step | .github/workflows/poisonable_steps.yml:20:14:20:73 | pip install nbformat && python scripts/generate_notebooks.py |
| .github/workflows/poisonable_steps.yml:21:9:22:6 | Run Step | .github/workflows/poisonable_steps.yml:21:14:21:78 | python scripts/generate_theme.py --outfile js/storybook/theme.css |
| .github/workflows/poisonable_steps.yml:22:9:23:6 | Run Step | .github/workflows/poisonable_steps.yml:22:14:22:76 | ruby scripts/generate_theme.rb --outfile js/storybook/theme.css |
| .github/workflows/poisonable_steps.yml:23:9:23:93 | Run Step | .github/workflows/poisonable_steps.yml:23:14:23:92 | bundle run exec ruby scripts/generate_theme.rb --outfile js/storybook/theme.css |
| .github/workflows/test.yml:26:9:28:6 | Run Step: simplesink1 | .github/workflows/test.yml:26:13:26:23 | simplesink1 |
| .github/workflows/test.yml:26:9:28:6 | Run Step: simplesink1 | .github/workflows/test.yml:27:14:27:63 | echo ${{ steps.source.outputs.all_changed_files }} |
| .github/workflows/test.yml:28:9:31:2 | Run Step: simplesink2 | .github/workflows/test.yml:28:13:28:23 | simplesink2 |
@@ -282,6 +337,82 @@ parentNodes
| .github/workflows/multiline.yml:86:14:89:29 | {\n echo 'JSON_RESPONSE<<EOF'\n} >> "$GITHUB_ENV"\n | .github/workflows/multiline.yml:1:1:89:29 | on: |
| .github/workflows/multiline.yml:86:14:89:29 | {\n echo 'JSON_RESPONSE<<EOF'\n} >> "$GITHUB_ENV"\n | .github/workflows/multiline.yml:9:5:89:29 | Job: Test |
| .github/workflows/multiline.yml:86:14:89:29 | {\n echo 'JSON_RESPONSE<<EOF'\n} >> "$GITHUB_ENV"\n | .github/workflows/multiline.yml:85:9:89:29 | Run Step |
| .github/workflows/poisonable_steps.yml:1:5:1:8 | push | .github/workflows/poisonable_steps.yml:1:1:23:93 | on: push |
| .github/workflows/poisonable_steps.yml:1:5:1:8 | push | .github/workflows/poisonable_steps.yml:1:1:23:93 | on: push |
| .github/workflows/poisonable_steps.yml:1:5:1:8 | push | .github/workflows/poisonable_steps.yml:1:5:1:8 | push |
| .github/workflows/poisonable_steps.yml:1:5:1:8 | push | .github/workflows/poisonable_steps.yml:1:5:1:8 | push |
| .github/workflows/poisonable_steps.yml:1:5:1:8 | push | .github/workflows/poisonable_steps.yml:1:5:1:8 | push |
| .github/workflows/poisonable_steps.yml:5:5:23:93 | Job: local_commands | .github/workflows/poisonable_steps.yml:1:1:23:93 | on: push |
| .github/workflows/poisonable_steps.yml:5:14:5:26 | ubuntu-latest | .github/workflows/poisonable_steps.yml:1:1:23:93 | on: push |
| .github/workflows/poisonable_steps.yml:5:14:5:26 | ubuntu-latest | .github/workflows/poisonable_steps.yml:5:5:23:93 | Job: local_commands |
| .github/workflows/poisonable_steps.yml:7:9:8:6 | Run Step | .github/workflows/poisonable_steps.yml:5:5:23:93 | Job: local_commands |
| .github/workflows/poisonable_steps.yml:7:14:7:30 | venv/bin/activate | .github/workflows/poisonable_steps.yml:1:1:23:93 | on: push |
| .github/workflows/poisonable_steps.yml:7:14:7:30 | venv/bin/activate | .github/workflows/poisonable_steps.yml:5:5:23:93 | Job: local_commands |
| .github/workflows/poisonable_steps.yml:7:14:7:30 | venv/bin/activate | .github/workflows/poisonable_steps.yml:7:9:8:6 | Run Step |
| .github/workflows/poisonable_steps.yml:8:9:9:6 | Run Step | .github/workflows/poisonable_steps.yml:5:5:23:93 | Job: local_commands |
| .github/workflows/poisonable_steps.yml:8:14:8:32 | . venv/bin/activate | .github/workflows/poisonable_steps.yml:1:1:23:93 | on: push |
| .github/workflows/poisonable_steps.yml:8:14:8:32 | . venv/bin/activate | .github/workflows/poisonable_steps.yml:5:5:23:93 | Job: local_commands |
| .github/workflows/poisonable_steps.yml:8:14:8:32 | . venv/bin/activate | .github/workflows/poisonable_steps.yml:8:9:9:6 | Run Step |
| .github/workflows/poisonable_steps.yml:9:9:10:6 | Run Step | .github/workflows/poisonable_steps.yml:5:5:23:93 | Job: local_commands |
| .github/workflows/poisonable_steps.yml:9:14:9:42 | echo foo; . venv/bin/activate | .github/workflows/poisonable_steps.yml:1:1:23:93 | on: push |
| .github/workflows/poisonable_steps.yml:9:14:9:42 | echo foo; . venv/bin/activate | .github/workflows/poisonable_steps.yml:5:5:23:93 | Job: local_commands |
| .github/workflows/poisonable_steps.yml:9:14:9:42 | echo foo; . venv/bin/activate | .github/workflows/poisonable_steps.yml:9:9:10:6 | Run Step |
| .github/workflows/poisonable_steps.yml:10:9:11:6 | Run Step | .github/workflows/poisonable_steps.yml:5:5:23:93 | Job: local_commands |
| .github/workflows/poisonable_steps.yml:10:14:10:41 | echo foo;. venv/bin/activate | .github/workflows/poisonable_steps.yml:1:1:23:93 | on: push |
| .github/workflows/poisonable_steps.yml:10:14:10:41 | echo foo;. venv/bin/activate | .github/workflows/poisonable_steps.yml:5:5:23:93 | Job: local_commands |
| .github/workflows/poisonable_steps.yml:10:14:10:41 | echo foo;. venv/bin/activate | .github/workflows/poisonable_steps.yml:10:9:11:6 | Run Step |
| .github/workflows/poisonable_steps.yml:11:9:12:6 | Run Step | .github/workflows/poisonable_steps.yml:5:5:23:93 | Job: local_commands |
| .github/workflows/poisonable_steps.yml:11:14:11:42 | echo foo \|. venv/bin/activate | .github/workflows/poisonable_steps.yml:1:1:23:93 | on: push |
| .github/workflows/poisonable_steps.yml:11:14:11:42 | echo foo \|. venv/bin/activate | .github/workflows/poisonable_steps.yml:5:5:23:93 | Job: local_commands |
| .github/workflows/poisonable_steps.yml:11:14:11:42 | echo foo \|. venv/bin/activate | .github/workflows/poisonable_steps.yml:11:9:12:6 | Run Step |
| .github/workflows/poisonable_steps.yml:12:9:13:6 | Run Step | .github/workflows/poisonable_steps.yml:5:5:23:93 | Job: local_commands |
| .github/workflows/poisonable_steps.yml:12:14:12:32 | ./venv/bin/activate | .github/workflows/poisonable_steps.yml:1:1:23:93 | on: push |
| .github/workflows/poisonable_steps.yml:12:14:12:32 | ./venv/bin/activate | .github/workflows/poisonable_steps.yml:5:5:23:93 | Job: local_commands |
| .github/workflows/poisonable_steps.yml:12:14:12:32 | ./venv/bin/activate | .github/workflows/poisonable_steps.yml:12:9:13:6 | Run Step |
| .github/workflows/poisonable_steps.yml:13:9:14:6 | Run Step | .github/workflows/poisonable_steps.yml:5:5:23:93 | Job: local_commands |
| .github/workflows/poisonable_steps.yml:13:14:13:36 | sh venv/bin/activate.sh | .github/workflows/poisonable_steps.yml:1:1:23:93 | on: push |
| .github/workflows/poisonable_steps.yml:13:14:13:36 | sh venv/bin/activate.sh | .github/workflows/poisonable_steps.yml:5:5:23:93 | Job: local_commands |
| .github/workflows/poisonable_steps.yml:13:14:13:36 | sh venv/bin/activate.sh | .github/workflows/poisonable_steps.yml:13:9:14:6 | Run Step |
| .github/workflows/poisonable_steps.yml:14:9:15:6 | Run Step | .github/workflows/poisonable_steps.yml:5:5:23:93 | Job: local_commands |
| .github/workflows/poisonable_steps.yml:14:14:14:44 | echo $(sh venv/bin/activate.sh) | .github/workflows/poisonable_steps.yml:1:1:23:93 | on: push |
| .github/workflows/poisonable_steps.yml:14:14:14:44 | echo $(sh venv/bin/activate.sh) | .github/workflows/poisonable_steps.yml:5:5:23:93 | Job: local_commands |
| .github/workflows/poisonable_steps.yml:14:14:14:44 | echo $(sh venv/bin/activate.sh) | .github/workflows/poisonable_steps.yml:14:9:15:6 | Run Step |
| .github/workflows/poisonable_steps.yml:15:9:16:6 | Run Step | .github/workflows/poisonable_steps.yml:5:5:23:93 | Job: local_commands |
| .github/workflows/poisonable_steps.yml:15:14:15:56 | echo foo; sh venv/bin/activate.sh; echo bar | .github/workflows/poisonable_steps.yml:1:1:23:93 | on: push |
| .github/workflows/poisonable_steps.yml:15:14:15:56 | echo foo; sh venv/bin/activate.sh; echo bar | .github/workflows/poisonable_steps.yml:5:5:23:93 | Job: local_commands |
| .github/workflows/poisonable_steps.yml:15:14:15:56 | echo foo; sh venv/bin/activate.sh; echo bar | .github/workflows/poisonable_steps.yml:15:9:16:6 | Run Step |
| .github/workflows/poisonable_steps.yml:16:9:17:6 | Run Step | .github/workflows/poisonable_steps.yml:5:5:23:93 | Job: local_commands |
| .github/workflows/poisonable_steps.yml:16:14:16:56 | echo foo \| sh venv/bin/activate.sh > output | .github/workflows/poisonable_steps.yml:1:1:23:93 | on: push |
| .github/workflows/poisonable_steps.yml:16:14:16:56 | echo foo \| sh venv/bin/activate.sh > output | .github/workflows/poisonable_steps.yml:5:5:23:93 | Job: local_commands |
| .github/workflows/poisonable_steps.yml:16:14:16:56 | echo foo \| sh venv/bin/activate.sh > output | .github/workflows/poisonable_steps.yml:16:9:17:6 | Run Step |
| .github/workflows/poisonable_steps.yml:17:9:18:6 | Run Step | .github/workflows/poisonable_steps.yml:5:5:23:93 | Job: local_commands |
| .github/workflows/poisonable_steps.yml:17:14:17:40 | python venv/bin/activate.py | .github/workflows/poisonable_steps.yml:1:1:23:93 | on: push |
| .github/workflows/poisonable_steps.yml:17:14:17:40 | python venv/bin/activate.py | .github/workflows/poisonable_steps.yml:5:5:23:93 | Job: local_commands |
| .github/workflows/poisonable_steps.yml:17:14:17:40 | python venv/bin/activate.py | .github/workflows/poisonable_steps.yml:17:9:18:6 | Run Step |
| .github/workflows/poisonable_steps.yml:18:9:19:6 | Run Step | .github/workflows/poisonable_steps.yml:5:5:23:93 | Job: local_commands |
| .github/workflows/poisonable_steps.yml:18:14:18:50 | echo foo; python venv/bin/activate.py | .github/workflows/poisonable_steps.yml:1:1:23:93 | on: push |
| .github/workflows/poisonable_steps.yml:18:14:18:50 | echo foo; python venv/bin/activate.py | .github/workflows/poisonable_steps.yml:5:5:23:93 | Job: local_commands |
| .github/workflows/poisonable_steps.yml:18:14:18:50 | echo foo; python venv/bin/activate.py | .github/workflows/poisonable_steps.yml:18:9:19:6 | Run Step |
| .github/workflows/poisonable_steps.yml:19:9:20:6 | Run Step | .github/workflows/poisonable_steps.yml:5:5:23:93 | Job: local_commands |
| .github/workflows/poisonable_steps.yml:19:14:19:29 | pnpm run test:ct | .github/workflows/poisonable_steps.yml:1:1:23:93 | on: push |
| .github/workflows/poisonable_steps.yml:19:14:19:29 | pnpm run test:ct | .github/workflows/poisonable_steps.yml:5:5:23:93 | Job: local_commands |
| .github/workflows/poisonable_steps.yml:19:14:19:29 | pnpm run test:ct | .github/workflows/poisonable_steps.yml:19:9:20:6 | Run Step |
| .github/workflows/poisonable_steps.yml:20:9:21:6 | Run Step | .github/workflows/poisonable_steps.yml:5:5:23:93 | Job: local_commands |
| .github/workflows/poisonable_steps.yml:20:14:20:73 | pip install nbformat && python scripts/generate_notebooks.py | .github/workflows/poisonable_steps.yml:1:1:23:93 | on: push |
| .github/workflows/poisonable_steps.yml:20:14:20:73 | pip install nbformat && python scripts/generate_notebooks.py | .github/workflows/poisonable_steps.yml:5:5:23:93 | Job: local_commands |
| .github/workflows/poisonable_steps.yml:20:14:20:73 | pip install nbformat && python scripts/generate_notebooks.py | .github/workflows/poisonable_steps.yml:20:9:21:6 | Run Step |
| .github/workflows/poisonable_steps.yml:21:9:22:6 | Run Step | .github/workflows/poisonable_steps.yml:5:5:23:93 | Job: local_commands |
| .github/workflows/poisonable_steps.yml:21:14:21:78 | python scripts/generate_theme.py --outfile js/storybook/theme.css | .github/workflows/poisonable_steps.yml:1:1:23:93 | on: push |
| .github/workflows/poisonable_steps.yml:21:14:21:78 | python scripts/generate_theme.py --outfile js/storybook/theme.css | .github/workflows/poisonable_steps.yml:5:5:23:93 | Job: local_commands |
| .github/workflows/poisonable_steps.yml:21:14:21:78 | python scripts/generate_theme.py --outfile js/storybook/theme.css | .github/workflows/poisonable_steps.yml:21:9:22:6 | Run Step |
| .github/workflows/poisonable_steps.yml:22:9:23:6 | Run Step | .github/workflows/poisonable_steps.yml:5:5:23:93 | Job: local_commands |
| .github/workflows/poisonable_steps.yml:22:14:22:76 | ruby scripts/generate_theme.rb --outfile js/storybook/theme.css | .github/workflows/poisonable_steps.yml:1:1:23:93 | on: push |
| .github/workflows/poisonable_steps.yml:22:14:22:76 | ruby scripts/generate_theme.rb --outfile js/storybook/theme.css | .github/workflows/poisonable_steps.yml:5:5:23:93 | Job: local_commands |
| .github/workflows/poisonable_steps.yml:22:14:22:76 | ruby scripts/generate_theme.rb --outfile js/storybook/theme.css | .github/workflows/poisonable_steps.yml:22:9:23:6 | Run Step |
| .github/workflows/poisonable_steps.yml:23:9:23:93 | Run Step | .github/workflows/poisonable_steps.yml:5:5:23:93 | Job: local_commands |
| .github/workflows/poisonable_steps.yml:23:14:23:92 | bundle run exec ruby scripts/generate_theme.rb --outfile js/storybook/theme.css | .github/workflows/poisonable_steps.yml:1:1:23:93 | on: push |
| .github/workflows/poisonable_steps.yml:23:14:23:92 | bundle run exec ruby scripts/generate_theme.rb --outfile js/storybook/theme.css | .github/workflows/poisonable_steps.yml:5:5:23:93 | Job: local_commands |
| .github/workflows/poisonable_steps.yml:23:14:23:92 | bundle run exec ruby scripts/generate_theme.rb --outfile js/storybook/theme.css | .github/workflows/poisonable_steps.yml:23:9:23:93 | Run Step |
| .github/workflows/test.yml:1:5:1:8 | push | .github/workflows/test.yml:1:1:40:53 | on: push |
| .github/workflows/test.yml:1:5:1:8 | push | .github/workflows/test.yml:1:1:40:53 | on: push |
| .github/workflows/test.yml:1:5:1:8 | push | .github/workflows/test.yml:1:5:1:8 | push |
@@ -438,6 +569,45 @@ cfgNodes
| .github/workflows/multiline.yml:79:14:84:29 | {\n echo 'JSON_RESPONSE<<EOF'\n echo '$ISSUE'\n echo 'EOF'\n} >> "$GITHUB_ENV"\n |
| .github/workflows/multiline.yml:85:9:89:29 | Run Step |
| .github/workflows/multiline.yml:86:14:89:29 | {\n echo 'JSON_RESPONSE<<EOF'\n} >> "$GITHUB_ENV"\n |
| .github/workflows/poisonable_steps.yml:1:1:23:93 | enter on: push |
| .github/workflows/poisonable_steps.yml:1:1:23:93 | exit on: push |
| .github/workflows/poisonable_steps.yml:1:1:23:93 | exit on: push (normal) |
| .github/workflows/poisonable_steps.yml:1:1:23:93 | on: push |
| .github/workflows/poisonable_steps.yml:5:5:23:93 | Job: local_commands |
| .github/workflows/poisonable_steps.yml:7:9:8:6 | Run Step |
| .github/workflows/poisonable_steps.yml:7:14:7:30 | venv/bin/activate |
| .github/workflows/poisonable_steps.yml:8:9:9:6 | Run Step |
| .github/workflows/poisonable_steps.yml:8:14:8:32 | . venv/bin/activate |
| .github/workflows/poisonable_steps.yml:9:9:10:6 | Run Step |
| .github/workflows/poisonable_steps.yml:9:14:9:42 | echo foo; . venv/bin/activate |
| .github/workflows/poisonable_steps.yml:10:9:11:6 | Run Step |
| .github/workflows/poisonable_steps.yml:10:14:10:41 | echo foo;. venv/bin/activate |
| .github/workflows/poisonable_steps.yml:11:9:12:6 | Run Step |
| .github/workflows/poisonable_steps.yml:11:14:11:42 | echo foo \|. venv/bin/activate |
| .github/workflows/poisonable_steps.yml:12:9:13:6 | Run Step |
| .github/workflows/poisonable_steps.yml:12:14:12:32 | ./venv/bin/activate |
| .github/workflows/poisonable_steps.yml:13:9:14:6 | Run Step |
| .github/workflows/poisonable_steps.yml:13:14:13:36 | sh venv/bin/activate.sh |
| .github/workflows/poisonable_steps.yml:14:9:15:6 | Run Step |
| .github/workflows/poisonable_steps.yml:14:14:14:44 | echo $(sh venv/bin/activate.sh) |
| .github/workflows/poisonable_steps.yml:15:9:16:6 | Run Step |
| .github/workflows/poisonable_steps.yml:15:14:15:56 | echo foo; sh venv/bin/activate.sh; echo bar |
| .github/workflows/poisonable_steps.yml:16:9:17:6 | Run Step |
| .github/workflows/poisonable_steps.yml:16:14:16:56 | echo foo \| sh venv/bin/activate.sh > output |
| .github/workflows/poisonable_steps.yml:17:9:18:6 | Run Step |
| .github/workflows/poisonable_steps.yml:17:14:17:40 | python venv/bin/activate.py |
| .github/workflows/poisonable_steps.yml:18:9:19:6 | Run Step |
| .github/workflows/poisonable_steps.yml:18:14:18:50 | echo foo; python venv/bin/activate.py |
| .github/workflows/poisonable_steps.yml:19:9:20:6 | Run Step |
| .github/workflows/poisonable_steps.yml:19:14:19:29 | pnpm run test:ct |
| .github/workflows/poisonable_steps.yml:20:9:21:6 | Run Step |
| .github/workflows/poisonable_steps.yml:20:14:20:73 | pip install nbformat && python scripts/generate_notebooks.py |
| .github/workflows/poisonable_steps.yml:21:9:22:6 | Run Step |
| .github/workflows/poisonable_steps.yml:21:14:21:78 | python scripts/generate_theme.py --outfile js/storybook/theme.css |
| .github/workflows/poisonable_steps.yml:22:9:23:6 | Run Step |
| .github/workflows/poisonable_steps.yml:22:14:22:76 | ruby scripts/generate_theme.rb --outfile js/storybook/theme.css |
| .github/workflows/poisonable_steps.yml:23:9:23:93 | Run Step |
| .github/workflows/poisonable_steps.yml:23:14:23:92 | bundle run exec ruby scripts/generate_theme.rb --outfile js/storybook/theme.css |
| .github/workflows/test.yml:1:1:40:53 | enter on: push |
| .github/workflows/test.yml:1:1:40:53 | exit on: push |
| .github/workflows/test.yml:1:1:40:53 | exit on: push (normal) |
@@ -516,6 +686,41 @@ dfNodes
| .github/workflows/multiline.yml:79:14:84:29 | {\n echo 'JSON_RESPONSE<<EOF'\n echo '$ISSUE'\n echo 'EOF'\n} >> "$GITHUB_ENV"\n |
| .github/workflows/multiline.yml:85:9:89:29 | Run Step |
| .github/workflows/multiline.yml:86:14:89:29 | {\n echo 'JSON_RESPONSE<<EOF'\n} >> "$GITHUB_ENV"\n |
| .github/workflows/poisonable_steps.yml:5:5:23:93 | Job: local_commands |
| .github/workflows/poisonable_steps.yml:7:9:8:6 | Run Step |
| .github/workflows/poisonable_steps.yml:7:14:7:30 | venv/bin/activate |
| .github/workflows/poisonable_steps.yml:8:9:9:6 | Run Step |
| .github/workflows/poisonable_steps.yml:8:14:8:32 | . venv/bin/activate |
| .github/workflows/poisonable_steps.yml:9:9:10:6 | Run Step |
| .github/workflows/poisonable_steps.yml:9:14:9:42 | echo foo; . venv/bin/activate |
| .github/workflows/poisonable_steps.yml:10:9:11:6 | Run Step |
| .github/workflows/poisonable_steps.yml:10:14:10:41 | echo foo;. venv/bin/activate |
| .github/workflows/poisonable_steps.yml:11:9:12:6 | Run Step |
| .github/workflows/poisonable_steps.yml:11:14:11:42 | echo foo \|. venv/bin/activate |
| .github/workflows/poisonable_steps.yml:12:9:13:6 | Run Step |
| .github/workflows/poisonable_steps.yml:12:14:12:32 | ./venv/bin/activate |
| .github/workflows/poisonable_steps.yml:13:9:14:6 | Run Step |
| .github/workflows/poisonable_steps.yml:13:14:13:36 | sh venv/bin/activate.sh |
| .github/workflows/poisonable_steps.yml:14:9:15:6 | Run Step |
| .github/workflows/poisonable_steps.yml:14:14:14:44 | echo $(sh venv/bin/activate.sh) |
| .github/workflows/poisonable_steps.yml:15:9:16:6 | Run Step |
| .github/workflows/poisonable_steps.yml:15:14:15:56 | echo foo; sh venv/bin/activate.sh; echo bar |
| .github/workflows/poisonable_steps.yml:16:9:17:6 | Run Step |
| .github/workflows/poisonable_steps.yml:16:14:16:56 | echo foo \| sh venv/bin/activate.sh > output |
| .github/workflows/poisonable_steps.yml:17:9:18:6 | Run Step |
| .github/workflows/poisonable_steps.yml:17:14:17:40 | python venv/bin/activate.py |
| .github/workflows/poisonable_steps.yml:18:9:19:6 | Run Step |
| .github/workflows/poisonable_steps.yml:18:14:18:50 | echo foo; python venv/bin/activate.py |
| .github/workflows/poisonable_steps.yml:19:9:20:6 | Run Step |
| .github/workflows/poisonable_steps.yml:19:14:19:29 | pnpm run test:ct |
| .github/workflows/poisonable_steps.yml:20:9:21:6 | Run Step |
| .github/workflows/poisonable_steps.yml:20:14:20:73 | pip install nbformat && python scripts/generate_notebooks.py |
| .github/workflows/poisonable_steps.yml:21:9:22:6 | Run Step |
| .github/workflows/poisonable_steps.yml:21:14:21:78 | python scripts/generate_theme.py --outfile js/storybook/theme.css |
| .github/workflows/poisonable_steps.yml:22:9:23:6 | Run Step |
| .github/workflows/poisonable_steps.yml:22:14:22:76 | ruby scripts/generate_theme.rb --outfile js/storybook/theme.css |
| .github/workflows/poisonable_steps.yml:23:9:23:93 | Run Step |
| .github/workflows/poisonable_steps.yml:23:14:23:92 | bundle run exec ruby scripts/generate_theme.rb --outfile js/storybook/theme.css |
| .github/workflows/test.yml:5:5:31:2 | Job: job1 |
| .github/workflows/test.yml:8:7:10:4 | Job outputs node |
| .github/workflows/test.yml:8:20:8:50 | steps.step.outputs.value |
@@ -595,6 +800,41 @@ nodeLocations
| .github/workflows/multiline.yml:79:14:84:29 | {\n echo 'JSON_RESPONSE<<EOF'\n echo '$ISSUE'\n echo 'EOF'\n} >> "$GITHUB_ENV"\n | .github/workflows/multiline.yml:79:14:84:29 | .github/workflows/multiline.yml@79:14:84:29 |
| .github/workflows/multiline.yml:85:9:89:29 | Run Step | .github/workflows/multiline.yml:85:9:89:29 | .github/workflows/multiline.yml@85:9:89:29 |
| .github/workflows/multiline.yml:86:14:89:29 | {\n echo 'JSON_RESPONSE<<EOF'\n} >> "$GITHUB_ENV"\n | .github/workflows/multiline.yml:86:14:89:29 | .github/workflows/multiline.yml@86:14:89:29 |
| .github/workflows/poisonable_steps.yml:5:5:23:93 | Job: local_commands | .github/workflows/poisonable_steps.yml:5:5:23:93 | .github/workflows/poisonable_steps.yml@5:5:23:93 |
| .github/workflows/poisonable_steps.yml:7:9:8:6 | Run Step | .github/workflows/poisonable_steps.yml:7:9:8:6 | .github/workflows/poisonable_steps.yml@7:9:8:6 |
| .github/workflows/poisonable_steps.yml:7:14:7:30 | venv/bin/activate | .github/workflows/poisonable_steps.yml:7:14:7:30 | .github/workflows/poisonable_steps.yml@7:14:7:30 |
| .github/workflows/poisonable_steps.yml:8:9:9:6 | Run Step | .github/workflows/poisonable_steps.yml:8:9:9:6 | .github/workflows/poisonable_steps.yml@8:9:9:6 |
| .github/workflows/poisonable_steps.yml:8:14:8:32 | . venv/bin/activate | .github/workflows/poisonable_steps.yml:8:14:8:32 | .github/workflows/poisonable_steps.yml@8:14:8:32 |
| .github/workflows/poisonable_steps.yml:9:9:10:6 | Run Step | .github/workflows/poisonable_steps.yml:9:9:10:6 | .github/workflows/poisonable_steps.yml@9:9:10:6 |
| .github/workflows/poisonable_steps.yml:9:14:9:42 | echo foo; . venv/bin/activate | .github/workflows/poisonable_steps.yml:9:14:9:42 | .github/workflows/poisonable_steps.yml@9:14:9:42 |
| .github/workflows/poisonable_steps.yml:10:9:11:6 | Run Step | .github/workflows/poisonable_steps.yml:10:9:11:6 | .github/workflows/poisonable_steps.yml@10:9:11:6 |
| .github/workflows/poisonable_steps.yml:10:14:10:41 | echo foo;. venv/bin/activate | .github/workflows/poisonable_steps.yml:10:14:10:41 | .github/workflows/poisonable_steps.yml@10:14:10:41 |
| .github/workflows/poisonable_steps.yml:11:9:12:6 | Run Step | .github/workflows/poisonable_steps.yml:11:9:12:6 | .github/workflows/poisonable_steps.yml@11:9:12:6 |
| .github/workflows/poisonable_steps.yml:11:14:11:42 | echo foo \|. venv/bin/activate | .github/workflows/poisonable_steps.yml:11:14:11:42 | .github/workflows/poisonable_steps.yml@11:14:11:42 |
| .github/workflows/poisonable_steps.yml:12:9:13:6 | Run Step | .github/workflows/poisonable_steps.yml:12:9:13:6 | .github/workflows/poisonable_steps.yml@12:9:13:6 |
| .github/workflows/poisonable_steps.yml:12:14:12:32 | ./venv/bin/activate | .github/workflows/poisonable_steps.yml:12:14:12:32 | .github/workflows/poisonable_steps.yml@12:14:12:32 |
| .github/workflows/poisonable_steps.yml:13:9:14:6 | Run Step | .github/workflows/poisonable_steps.yml:13:9:14:6 | .github/workflows/poisonable_steps.yml@13:9:14:6 |
| .github/workflows/poisonable_steps.yml:13:14:13:36 | sh venv/bin/activate.sh | .github/workflows/poisonable_steps.yml:13:14:13:36 | .github/workflows/poisonable_steps.yml@13:14:13:36 |
| .github/workflows/poisonable_steps.yml:14:9:15:6 | Run Step | .github/workflows/poisonable_steps.yml:14:9:15:6 | .github/workflows/poisonable_steps.yml@14:9:15:6 |
| .github/workflows/poisonable_steps.yml:14:14:14:44 | echo $(sh venv/bin/activate.sh) | .github/workflows/poisonable_steps.yml:14:14:14:44 | .github/workflows/poisonable_steps.yml@14:14:14:44 |
| .github/workflows/poisonable_steps.yml:15:9:16:6 | Run Step | .github/workflows/poisonable_steps.yml:15:9:16:6 | .github/workflows/poisonable_steps.yml@15:9:16:6 |
| .github/workflows/poisonable_steps.yml:15:14:15:56 | echo foo; sh venv/bin/activate.sh; echo bar | .github/workflows/poisonable_steps.yml:15:14:15:56 | .github/workflows/poisonable_steps.yml@15:14:15:56 |
| .github/workflows/poisonable_steps.yml:16:9:17:6 | Run Step | .github/workflows/poisonable_steps.yml:16:9:17:6 | .github/workflows/poisonable_steps.yml@16:9:17:6 |
| .github/workflows/poisonable_steps.yml:16:14:16:56 | echo foo \| sh venv/bin/activate.sh > output | .github/workflows/poisonable_steps.yml:16:14:16:56 | .github/workflows/poisonable_steps.yml@16:14:16:56 |
| .github/workflows/poisonable_steps.yml:17:9:18:6 | Run Step | .github/workflows/poisonable_steps.yml:17:9:18:6 | .github/workflows/poisonable_steps.yml@17:9:18:6 |
| .github/workflows/poisonable_steps.yml:17:14:17:40 | python venv/bin/activate.py | .github/workflows/poisonable_steps.yml:17:14:17:40 | .github/workflows/poisonable_steps.yml@17:14:17:40 |
| .github/workflows/poisonable_steps.yml:18:9:19:6 | Run Step | .github/workflows/poisonable_steps.yml:18:9:19:6 | .github/workflows/poisonable_steps.yml@18:9:19:6 |
| .github/workflows/poisonable_steps.yml:18:14:18:50 | echo foo; python venv/bin/activate.py | .github/workflows/poisonable_steps.yml:18:14:18:50 | .github/workflows/poisonable_steps.yml@18:14:18:50 |
| .github/workflows/poisonable_steps.yml:19:9:20:6 | Run Step | .github/workflows/poisonable_steps.yml:19:9:20:6 | .github/workflows/poisonable_steps.yml@19:9:20:6 |
| .github/workflows/poisonable_steps.yml:19:14:19:29 | pnpm run test:ct | .github/workflows/poisonable_steps.yml:19:14:19:29 | .github/workflows/poisonable_steps.yml@19:14:19:29 |
| .github/workflows/poisonable_steps.yml:20:9:21:6 | Run Step | .github/workflows/poisonable_steps.yml:20:9:21:6 | .github/workflows/poisonable_steps.yml@20:9:21:6 |
| .github/workflows/poisonable_steps.yml:20:14:20:73 | pip install nbformat && python scripts/generate_notebooks.py | .github/workflows/poisonable_steps.yml:20:14:20:73 | .github/workflows/poisonable_steps.yml@20:14:20:73 |
| .github/workflows/poisonable_steps.yml:21:9:22:6 | Run Step | .github/workflows/poisonable_steps.yml:21:9:22:6 | .github/workflows/poisonable_steps.yml@21:9:22:6 |
| .github/workflows/poisonable_steps.yml:21:14:21:78 | python scripts/generate_theme.py --outfile js/storybook/theme.css | .github/workflows/poisonable_steps.yml:21:14:21:78 | .github/workflows/poisonable_steps.yml@21:14:21:78 |
| .github/workflows/poisonable_steps.yml:22:9:23:6 | Run Step | .github/workflows/poisonable_steps.yml:22:9:23:6 | .github/workflows/poisonable_steps.yml@22:9:23:6 |
| .github/workflows/poisonable_steps.yml:22:14:22:76 | ruby scripts/generate_theme.rb --outfile js/storybook/theme.css | .github/workflows/poisonable_steps.yml:22:14:22:76 | .github/workflows/poisonable_steps.yml@22:14:22:76 |
| .github/workflows/poisonable_steps.yml:23:9:23:93 | Run Step | .github/workflows/poisonable_steps.yml:23:9:23:93 | .github/workflows/poisonable_steps.yml@23:9:23:93 |
| .github/workflows/poisonable_steps.yml:23:14:23:92 | bundle run exec ruby scripts/generate_theme.rb --outfile js/storybook/theme.css | .github/workflows/poisonable_steps.yml:23:14:23:92 | .github/workflows/poisonable_steps.yml@23:14:23:92 |
| .github/workflows/test.yml:5:5:31:2 | Job: job1 | .github/workflows/test.yml:5:5:31:2 | .github/workflows/test.yml@5:5:31:2 |
| .github/workflows/test.yml:8:7:10:4 | Job outputs node | .github/workflows/test.yml:8:7:10:4 | .github/workflows/test.yml@8:7:10:4 |
| .github/workflows/test.yml:8:20:8:50 | steps.step.outputs.value | .github/workflows/test.yml:8:20:8:50 | .github/workflows/test.yml@8:20:8:50 |
@@ -615,6 +855,7 @@ nodeLocations
scopes
| .github/workflows/expression_nodes.yml:1:1:21:47 | on: issue_comment |
| .github/workflows/multiline.yml:1:1:89:29 | on: |
| .github/workflows/poisonable_steps.yml:1:1:23:93 | on: push |
| .github/workflows/test.yml:1:1:40:53 | on: push |
sources
| ahmadnassri/action-changed-files | * | output.files | filename | manual |

58
ql/test/query-tests/Security/CWE-829/.github/workflows/test7.yml vendored Normal file
View File

@@ -0,0 +1,58 @@
name: Benchmark
on:
issue_comment:
types: [created]
env:
TURBO_TOKEN: ${{ secrets.TURBO_TOKEN }}
TURBO_TEAM: ${{ secrets.TURBO_TEAM }}
FORCE_COLOR: true
jobs:
benchmark:
if: ${{ github.repository_owner == 'foo' && github.event.issue.pull_request && startsWith(github.event.comment.body, '!bench') }}
runs-on: ubuntu-latest
permissions:
contents: read
steps:
- uses: actions/checkout@v4
with:
persist-credentials: false
ref: refs/pull/${{ github.event.issue.number }}/head
- name: Setup PNPM
uses: pnpm/action-setup@v3
- name: Setup Node
uses: actions/setup-node@v4
with:
node-version: 18
cache: "pnpm"
- name: Install dependencies
run: pnpm install
- name: Build Packages
run: pnpm run build
- name: Get bench command
id: bench-command
env:
# protects from untrusted user input and command injection
COMMENT: ${{ github.event.comment.body }}
run: |
benchcmd=$(echo "$COMMENT" | grep '!bench' | awk -F ' ' '{print $2}')
echo "bench=$benchcmd" >> $GITHUB_OUTPUT
shell: bash
- name: Run benchmark
id: benchmark-pr
run: |
result=$(pnpm run --silent benchmark ${{ steps.bench-command.outputs.bench }})
processed=$(node ./benchmark/ci-helper.js "$result")
echo "BENCH_RESULT<<BENCHEOF" >> $GITHUB_OUTPUT
echo "### PR Benchmark" >> $GITHUB_OUTPUT
echo "$processed" >> $GITHUB_OUTPUT
echo "BENCHEOF" >> $GITHUB_OUTPUT
shell: bash

1
ql/test/query-tests/Security/CWE-829/UnpinnedActionsTag.expected
View File

@@ -16,4 +16,5 @@
| .github/workflows/label_trusted_checkout.yml:24:7:27:21 | Uses Step | Unpinned 3rd party Action 'label_trusted_checkout.yml' step $@ uses 'fakerepo/comment-on-pr' with ref '1', not a pinned commit hash | .github/workflows/label_trusted_checkout.yml:24:7:27:21 | Uses Step | Uses Step |
| .github/workflows/level0.yml:36:9:39:6 | Uses Step | Unpinned 3rd party Action 'Poutine Level 0' step $@ uses 'rlespinasse/github-slug-action' with ref '4', not a pinned commit hash | .github/workflows/level0.yml:36:9:39:6 | Uses Step | Uses Step |
| .github/workflows/mend.yml:29:9:33:28 | Uses Step | Unpinned 3rd party Action 'Test' step $@ uses 'ruby/setup-ruby' with ref '1', not a pinned commit hash | .github/workflows/mend.yml:29:9:33:28 | Uses Step | Uses Step |
| .github/workflows/test7.yml:24:9:27:6 | Uses Step | Unpinned 3rd party Action 'Benchmark' step $@ uses 'pnpm/action-setup' with ref '3', not a pinned commit hash | .github/workflows/test7.yml:24:9:27:6 | Uses Step | Uses Step |
| .github/workflows/unpinned_tags.yml:10:7:11:4 | Uses Step | Unpinned 3rd party Action 'unpinned_tags.yml' step $@ uses 'foo/bar' with ref '1', not a pinned commit hash | .github/workflows/unpinned_tags.yml:10:7:11:4 | Uses Step | Uses Step |

24
ql/test/query-tests/Security/CWE-829/UntrustedCheckoutCritical.expected
View File

@@ -304,6 +304,27 @@ edges
| .github/workflows/test6.yml:19:9:39:6 | Uses Step | .github/workflows/test6.yml:39:9:43:6 | Run Step |
| .github/workflows/test6.yml:19:9:39:6 | Uses Step | .github/workflows/test6.yml:43:9:45:52 | Run Step |
| .github/workflows/test6.yml:39:9:43:6 | Run Step | .github/workflows/test6.yml:43:9:45:52 | Run Step |
| .github/workflows/test7.yml:19:9:24:6 | Uses Step | .github/workflows/test7.yml:24:9:27:6 | Uses Step |
| .github/workflows/test7.yml:19:9:24:6 | Uses Step | .github/workflows/test7.yml:27:9:33:6 | Uses Step |
| .github/workflows/test7.yml:19:9:24:6 | Uses Step | .github/workflows/test7.yml:33:9:36:6 | Run Step |
| .github/workflows/test7.yml:19:9:24:6 | Uses Step | .github/workflows/test7.yml:36:9:39:6 | Run Step |
| .github/workflows/test7.yml:19:9:24:6 | Uses Step | .github/workflows/test7.yml:39:9:49:6 | Run Step: bench-command |
| .github/workflows/test7.yml:19:9:24:6 | Uses Step | .github/workflows/test7.yml:49:9:58:20 | Run Step: benchmark-pr |
| .github/workflows/test7.yml:24:9:27:6 | Uses Step | .github/workflows/test7.yml:27:9:33:6 | Uses Step |
| .github/workflows/test7.yml:24:9:27:6 | Uses Step | .github/workflows/test7.yml:33:9:36:6 | Run Step |
| .github/workflows/test7.yml:24:9:27:6 | Uses Step | .github/workflows/test7.yml:36:9:39:6 | Run Step |
| .github/workflows/test7.yml:24:9:27:6 | Uses Step | .github/workflows/test7.yml:39:9:49:6 | Run Step: bench-command |
| .github/workflows/test7.yml:24:9:27:6 | Uses Step | .github/workflows/test7.yml:49:9:58:20 | Run Step: benchmark-pr |
| .github/workflows/test7.yml:27:9:33:6 | Uses Step | .github/workflows/test7.yml:33:9:36:6 | Run Step |
| .github/workflows/test7.yml:27:9:33:6 | Uses Step | .github/workflows/test7.yml:36:9:39:6 | Run Step |
| .github/workflows/test7.yml:27:9:33:6 | Uses Step | .github/workflows/test7.yml:39:9:49:6 | Run Step: bench-command |
| .github/workflows/test7.yml:27:9:33:6 | Uses Step | .github/workflows/test7.yml:49:9:58:20 | Run Step: benchmark-pr |
| .github/workflows/test7.yml:33:9:36:6 | Run Step | .github/workflows/test7.yml:36:9:39:6 | Run Step |
| .github/workflows/test7.yml:33:9:36:6 | Run Step | .github/workflows/test7.yml:39:9:49:6 | Run Step: bench-command |
| .github/workflows/test7.yml:33:9:36:6 | Run Step | .github/workflows/test7.yml:49:9:58:20 | Run Step: benchmark-pr |
| .github/workflows/test7.yml:36:9:39:6 | Run Step | .github/workflows/test7.yml:39:9:49:6 | Run Step: bench-command |
| .github/workflows/test7.yml:36:9:39:6 | Run Step | .github/workflows/test7.yml:49:9:58:20 | Run Step: benchmark-pr |
| .github/workflows/test7.yml:39:9:49:6 | Run Step: bench-command | .github/workflows/test7.yml:49:9:58:20 | Run Step: benchmark-pr |
| .github/workflows/test.yml:13:9:14:6 | Uses Step | .github/workflows/test.yml:14:9:25:6 | Run Step |
| .github/workflows/test.yml:13:9:14:6 | Uses Step | .github/workflows/test.yml:25:9:33:6 | Run Step |
| .github/workflows/test.yml:13:9:14:6 | Uses Step | .github/workflows/test.yml:33:9:37:34 | Run Step |
@@ -335,5 +356,8 @@ edges
| .github/workflows/test5.yml:32:9:34:2 | Run Step | .github/workflows/test5.yml:28:9:32:6 | Uses Step | .github/workflows/test5.yml:32:9:34:2 | Run Step | Execution of untrusted code on a privileged workflow. |
| .github/workflows/test5.yml:58:9:60:2 | Run Step | .github/workflows/test5.yml:54:9:58:6 | Uses Step | .github/workflows/test5.yml:58:9:60:2 | Run Step | Execution of untrusted code on a privileged workflow. |
| .github/workflows/test5.yml:68:9:68:43 | Run Step | .github/workflows/test5.yml:64:9:68:6 | Uses Step | .github/workflows/test5.yml:68:9:68:43 | Run Step | Execution of untrusted code on a privileged workflow. |
| .github/workflows/test7.yml:33:9:36:6 | Run Step | .github/workflows/test7.yml:19:9:24:6 | Uses Step | .github/workflows/test7.yml:33:9:36:6 | Run Step | Execution of untrusted code on a privileged workflow. |
| .github/workflows/test7.yml:36:9:39:6 | Run Step | .github/workflows/test7.yml:19:9:24:6 | Uses Step | .github/workflows/test7.yml:36:9:39:6 | Run Step | Execution of untrusted code on a privileged workflow. |
| .github/workflows/test7.yml:49:9:58:20 | Run Step: benchmark-pr | .github/workflows/test7.yml:19:9:24:6 | Uses Step | .github/workflows/test7.yml:49:9:58:20 | Run Step: benchmark-pr | Execution of untrusted code on a privileged workflow. |
| .github/workflows/untrusted_checkout.yml:20:9:22:23 | Run Step | .github/workflows/untrusted_checkout.yml:10:9:13:6 | Uses Step | .github/workflows/untrusted_checkout.yml:20:9:22:23 | Run Step | Execution of untrusted code on a privileged workflow. |
| .github/workflows/untrusted_checkout.yml:20:9:22:23 | Run Step | .github/workflows/untrusted_checkout.yml:13:9:16:6 | Uses Step | .github/workflows/untrusted_checkout.yml:20:9:22:23 | Run Step | Execution of untrusted code on a privileged workflow. |