hohn/codeql
1
0
Fork 0
mirror of https://github.com/github/codeql.git synced 2025-12-27 14:16:34 +01:00
Code Issues Packages Projects Releases Wiki Activity

Remove caching actions that cache files outside of the CWD

Browse Source
This commit is contained in:
Alvaro Muñoz
2024-08-06 10:47:12 +02:00
parent 14f1672e74
commit fbc2e1e7e8
1 changed files with 3 additions and 78 deletions
Download Patch File Download Diff File Expand all files Collapse all files

81
ql/lib/codeql/actions/security/CachePoisoningQuery.qll
View File

@@ -51,87 +51,13 @@ abstract class CacheWritingStep extends Step {
class CacheActionUsesStep extends CacheWritingStep, UsesStep {
CacheActionUsesStep() { this.getCallee() = "actions/cache" }
override string getPath() {
if exists(this.(UsesStep).getArgument("path"))
then result = this.(UsesStep).getArgument("path").splitAt("\n")
else result = "?"
}
override string getPath() { result = this.(UsesStep).getArgument("path").splitAt("\n") }
}
class CacheActionSaveUsesStep extends CacheWritingStep, UsesStep {
CacheActionSaveUsesStep() { this.getCallee() = "actions/cache/save" }
override string getPath() {
if exists(this.(UsesStep).getArgument("path"))
then result = this.(UsesStep).getArgument("path").splitAt("\n")
else result = "?"
}
}
class SetupJavaUsesStep extends CacheWritingStep, UsesStep {
SetupJavaUsesStep() {
this.getCallee() = "actions/setup-java" and
(
exists(this.getArgument("cache")) or
exists(this.getArgument("cache-dependency-path"))
)
}
// TODO: Try to get the actual path being cached
override string getPath() { result = "?" }
}
class SetupGoUsesStep extends CacheWritingStep, UsesStep {
SetupGoUsesStep() {
this.getCallee() = "actions/setup-go" and
(
not exists(this.getArgument("cache"))
or
this.getArgument("cache") = "true"
)
}
// TODO: Try to get the actual path being cached
override string getPath() { result = "?" }
}
class SetupNodeUsesStep extends CacheWritingStep, UsesStep {
SetupNodeUsesStep() {
this.getCallee() = "actions/setup-node" and
(
exists(this.getArgument("cache")) or
exists(this.getArgument("cache-dependency-path"))
)
}
// TODO: Try to get the actual path being cached
override string getPath() { result = "?" }
}
class SetupPythonUsesStep extends CacheWritingStep, UsesStep {
SetupPythonUsesStep() {
this.getCallee() = "actions/setup-python" and
(
exists(this.getArgument("cache")) or
exists(this.getArgument("cache-dependency-path"))
)
}
// TODO: Try to get the actual path being cached
override string getPath() { result = "?" }
}
class SetupDotnetUsesStep extends CacheWritingStep, UsesStep {
SetupDotnetUsesStep() {
this.getCallee() = "actions/setup-dotnet" and
(
this.getArgument("cache") = "true" or
exists(this.getArgument("cache-dependency-path"))
)
}
// TODO: Try to get the actual path being cached
override string getPath() { result = "?" }
override string getPath() { result = this.(UsesStep).getArgument("path").splitAt("\n") }
}
class SetupRubyUsesStep extends CacheWritingStep, UsesStep {
@@ -140,6 +66,5 @@ class SetupRubyUsesStep extends CacheWritingStep, UsesStep {
this.getArgument("bundler-cache") = "true"
}
// TODO: Try to get the actual path being cached
override string getPath() { result = "?" }
override string getPath() { result = "vendor/bundle" }
}