hohn/codeql
1
0
Fork 0
mirror of https://github.com/github/codeql.git synced 2026-07-23 20:22:02 +02:00
Code Issues Packages Projects Releases Wiki Activity
88,607 Commits 1,815 Branches 171 Tags
copilot/add-cpp-regular-expression-parser
Commit Graph

3 Commits

Author SHA1 Message Date
Paolo Tranquilli
e807545591 Remove false positive docker/build-push-action context sink model 
The `context` input is passed as a single array element through
`docker/actions-toolkit` and `@actions/exec` all the way to
`child_process.spawn()`, which does not perform shell splitting.
No code injection is possible.

Fixes https://github.com/github/codeql/issues/21428
 2026-03-26 09:08:34 +01:00
Paolo Tranquilli
55d16e8781 Remove false-positive command-injection sink model for step-security/harden-runner 
The `allowed-endpoints` input only flows to `execFileSync("echo", [content])`
(no shell) and `fs.writeFileSync` (JSON config), neither of which is a
command injection vector.

Fixes https://github.com/github/codeql/issues/21568
 2026-03-25 10:58:16 +01:00
Dave Bartolomeo
ee7680df84 Move into actions subdirectory to prepare for migration to github/codeql 2024-12-18 14:35:15 -05:00