hohn/codeql
1
0
Fork 0
mirror of https://github.com/github/codeql.git synced 2026-04-30 11:15:13 +02:00
Code Issues Packages Projects Releases Wiki Activity

Apply suggestions from code review

Browse Source 
Co-authored-by: Jaroslav Lobačevski <jarlob@github.com>
This commit is contained in:
Alvaro Muñoz
2024-03-14 09:22:05 +01:00
committed by GitHub
parent 872b1f88f0
commit fe1bf58ae5
1 changed files with 2 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files

3
ql/src/Security/CWE-829/UntrustedCheckout.ql
View File

@@ -37,6 +37,7 @@ predicate containsHeadRef(string s) {
Utils::normalizeExpr(s)
.regexpFind([
"\\bgithub\\.event\\.number\\b", // The pull request number.
"\\bgithub\\.event\\.issue\\.number\\b", // The pull request number on issue_comment.
"\\bgithub\\.event\\.pull_request\\.head\\.ref\\b", // The ref name of head.
"\\bgithub\\.event\\.pull_request\\.head\\.sha\\b", // The commit SHA of head.
"\\bgithub\\.event\\.pull_request\\.id\\b", // The pull request ID.
@@ -82,7 +83,7 @@ class GitCheckout extends PRHeadCheckoutStep instanceof Run {
from Workflow w, PRHeadCheckoutStep checkout
where
w.hasTriggerEvent(["pull_request_target", "issue_comment", "workflow_run"]) and
w.hasTriggerEvent(["pull_request_target", "issue_comment", "pull_request_review_comment", "pull_request_review", "workflow_run", "check_run", "check_suite", "workflow_call"]) and
w.getAJob().(LocalJob).getAStep() = checkout and
not exists(ControlCheck check |
checkout.getIf() = check or checkout.getEnclosingJob().getIf() = check