48 Commits

Author	SHA1	Message	Date
Alvaro Muñoz	7d2cbc1f50	Improve Bash script parser	2024-10-03 14:13:27 +02:00
Alvaro Muñoz	531f3d40c0	Add tests for new bash parser	2024-10-02 12:35:09 +02:00
Alvaro Muñoz	df59e6f5d2	Consider a Reusable Workflow privileged if a caller is	2024-09-23 10:18:29 +02:00
Alvaro Muñoz	5fe81ddb08	Update tests	2024-09-11 18:07:25 +02:00
Alvaro Muñoz	41fade5feb	feat(bash): Improve bash command parsing	2024-08-02 12:44:43 +02:00
Alvaro Muñoz	f457537b34	feat(bash): Add support for tee as a way to write to GITHUB special files	2024-08-01 17:47:23 +02:00
Alvaro Muñoz	a1787596d2	feat(tests): Update tests	2024-07-12 12:45:19 +02:00
Alvaro Muñoz	29d2b287c9	tests: Organize tests	2024-07-12 10:14:39 +02:00
Alvaro Muñoz	89024ad604	fix(models): Reuse command delimiter regexps	2024-07-11 22:58:20 +02:00
Alvaro Muñoz	8231261ccf	New poisonable steps	2024-07-09 17:28:04 +02:00
Alvaro Muñoz	ee265c4879	fix(models): Slash-command-action ... Do not consider slash-command-action command-arguments as a remote flow source if it requires write or admin permissions	2024-07-08 22:38:53 +02:00
Alvaro Muñoz	20ce5d5344	Add JS local imports as Poisonable steps	2024-07-08 12:59:16 +02:00
Alvaro Muñoz	bc483fc380	Add poisonable step test	2024-07-06 22:44:57 +02:00
Alvaro Muñoz	e5064f8090	Improve poisonable steps	2024-07-05 18:16:50 +02:00
Alvaro Muñoz	61797e9180	Add pull_request-comment-branch head_ref as a source	2024-06-25 13:27:08 +02:00
Alvaro Muñoz	fc8173239e	Move configuration to MaD files	2024-06-25 09:47:43 +02:00
Alvaro Muñoz	ad1f35c86a	Move from yaml to js extractor	2024-06-11 21:24:22 +02:00
Alvaro Muñoz	3e9c19044e	Improve bash and source regexpps	2024-05-31 16:01:27 +02:00
Alvaro Muñoz	5d32071adc	resolve conflicts	2024-05-21 23:02:34 +02:00
Jaroslav Lobačevski	6e8fc89034	Add default branch name check	2024-05-15 09:29:24 +00:00
Alvaro Muñoz	f96b9cc535	Update tests	2024-05-14 15:35:13 +02:00
Alvaro Muñoz	4d61204404	New tests	2024-05-10 14:12:25 +02:00
Alvaro Muñoz	de74b88866	Update	2024-05-08 09:43:32 +02:00
Alvaro Muñoz	ddf4bb194e	Fix incorrect source for dorny path filters	2024-05-06 23:32:06 +02:00
Alvaro Muñoz	00f6ff8c01	Split sources by taint type	2024-04-27 11:02:33 +02:00
Alvaro Muñoz	27d0a3406d	Improve Env path/var injection queries	2024-04-26 16:17:29 +02:00
Alvaro Muñoz	61976c684e	Lower privilege checks to Jobs	2024-04-22 23:28:58 +02:00
Alvaro Muñoz	d18c575cd4	fix broken models	2024-04-17 11:22:45 +02:00
Alvaro Muñoz	db86c40c50	Enable dataflow through GITHUB_ENV vars	2024-04-12 13:07:40 +02:00
Alvaro Muñoz	ed70ef0307	Make Artifact poisoning query a path problem	2024-04-11 15:46:49 +02:00
Alvaro Muñoz	b761565dcf	Merge branch 'master' of https://github.com/GitHubSecurityLab/codeql-actions	2024-04-11 15:18:19 +02:00
Alvaro Muñoz	1b2e02df64	Add support for multiline assigments	2024-04-11 15:18:09 +02:00
Alvaro Muñoz	4f0ec73307	Merge pull request #46 from GitHubSecurityLab/ca-rw-sinks ... Add models for composite actions and reusable workflows sinks	2024-04-11 12:02:01 +02:00
jorgectf	c56f220b13	Add provenance field	2024-04-11 11:23:28 +02:00
Alvaro Muñoz	58b21d4684	Improve assignments to GITHUB ENVARS detection	2024-04-08 18:52:13 +02:00
Alvaro Muñoz	31a1ea9593	Improve envvar injection	2024-04-08 17:12:00 +02:00
Alvaro Muñoz	56d2d8ec10	Update test results	2024-04-08 12:54:30 +02:00
Alvaro Muñoz	2651e5a673	Improve Artifact poisoning related queries	2024-04-08 12:52:10 +02:00
Alvaro Muñoz	28ccf4fa68	Improve Artifact Poisoning query	2024-04-05 09:18:01 +02:00
Alvaro Muñoz	2ed3aceddf	feat(sources): Do not take triggers into consideration	2024-03-22 13:32:29 +01:00
Alvaro Muñoz	46afa9c1f3	Add new tests	2024-03-14 22:41:01 +01:00
Alvaro Muñoz	839d16cde5	Treat If's values as expression no matter the delimiters	2024-03-13 18:41:17 +01:00
Alvaro Muñoz	9b97dbd870	Refactor ast nodes	2024-03-12 10:16:43 +01:00
Alvaro Muñoz	96246f4b74	Add Expression nodes and their corresponding locations	2024-03-07 15:35:47 +01:00
Alvaro Muñoz	1c2f19f4e1	Merge Actions.qll and Ast.qll	2024-03-01 16:06:06 +01:00
Alvaro Muñoz	bcf3081259	Refactor Input/Outpts	2024-03-01 11:17:23 +01:00
Alvaro Muñoz	0eabdd9507	Rename classes	2024-03-01 09:44:33 +01:00
Alvaro Muñoz	6b11506abb	test: Add tests	2024-02-29 13:23:59 +01:00