Skip to content

Commit f09e79a

Browse files
author
Alvaro Muñoz
authored
Merge pull request #33 from github/fix_32
Add context paths containing tainted fields
2 parents 3120d4b + 7a66b12 commit f09e79a

4 files changed

Lines changed: 38 additions & 17 deletions

File tree

‎ql/lib/codeql/actions/dataflow/FlowSources.qll‎

Lines changed: 13 additions & 17 deletions
Original file line numberDiff line numberDiff line change
@@ -76,22 +76,6 @@ private predicate textEvent(string context) {
7676
)
7777
}
7878

79-
// bindingset[context]
80-
// private predicate repoNameEvent(string context) {
81-
// exists(string reg |
82-
// reg =
83-
// [
84-
// // repo name
85-
// // Owner: All characters must be either a hyphen (-) or alphanumeric
86-
// // Repo: All code points must be either a hyphen (-), an underscore (_), a period (.), or an ASCII alphanumeric code point
87-
// "github\\.event\\.workflow_run\\.pull_requests\\[[0-9]+\\]\\.head\\.repo\\.name", // repo name
88-
// "github\\.event\\.workflow_run\\.head_repository\\.name", // repo name
89-
// "github\\.event\\.workflow_run\\.head_repository\\.full_name", // nwo
90-
// ]
91-
// |
92-
// Utils::normalizeExpr(context).regexpMatch(Utils::wrapRegexp(reg))
93-
// )
94-
// }
9579
bindingset[context]
9680
private predicate branchEvent(string context) {
9781
exists(string reg |
@@ -194,7 +178,19 @@ private predicate jsonEvent(string context) {
194178
reg =
195179
[
196180
// json
197-
"github\\.event",
181+
"github\\.event", "github\\.event\\.client_payload", "github\\.event\\.comment",
182+
"github\\.event\\.commits", "github\\.event\\.discussion", "github\\.event\\.head_commit",
183+
"github\\.event\\.head_commit\\.author", "github\\.event\\.head_commit\\.committer",
184+
"github\\.event\\.inputs", "github\\.event\\.issue", "github\\.event\\.merge_group",
185+
"github\\.event\\.merge_group\\.committer", "github\\.event\\.pull_request",
186+
"github\\.event\\.pull_request\\.head", "github\\.event\\.pull_request\\.head\\.repo",
187+
"github\\.event\\.pages", "github\\.event\\.review", "github\\.event\\.workflow",
188+
"github\\.event\\.workflow_run", "github\\.event\\.workflow_run\\.head_branch",
189+
"github\\.event\\.workflow_run\\.head_commit",
190+
"github\\.event\\.workflow_run\\.head_commit\\.author",
191+
"github\\.event\\.workflow_run\\.head_commit\\.committer",
192+
"github\\.event\\.workflow_run\\.head_repository",
193+
"github\\.event\\.workflow_run\\.pull_requests",
198194
]
199195
|
200196
Utils::normalizeExpr(context).regexpMatch(Utils::wrapRegexp(reg))

‎ql/test/query-tests/Security/CWE-094/.github/workflows/test4.yml‎

Lines changed: 19 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,19 @@
1+
name: Test
2+
on:
3+
issue_comment:
4+
types: [created, edited]
5+
6+
permissions:
7+
contents: write
8+
9+
jobs:
10+
test:
11+
runs-on: ubuntu-latest
12+
steps:
13+
- name: Dump GitHub comment context
14+
id: github_comment_step
15+
run: echo '${{ toJSON(github.event.comment) }}'
16+
17+
- name: Dump GitHub issue context
18+
id: github_issue_step
19+
run: echo '${{ toJSON(github.event.issue) }}'

‎ql/test/query-tests/Security/CWE-094/CodeInjection.expected‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -229,6 +229,8 @@ nodes
229229
| .github/workflows/test3.yml:11:17:11:70 | steps.issue_body_parser_request.outputs.payload | semmle.label | steps.issue_body_parser_request.outputs.payload |
230230
| .github/workflows/test3.yml:13:9:21:2 | Uses Step: issue_body_parser_request | semmle.label | Uses Step: issue_body_parser_request |
231231
| .github/workflows/test3.yml:60:27:60:66 | needs.parse-issue.outputs.payload | semmle.label | needs.parse-issue.outputs.payload |
232+
| .github/workflows/test4.yml:15:21:15:55 | toJSON(github.event.comment) | semmle.label | toJSON(github.event.comment) |
233+
| .github/workflows/test4.yml:19:21:19:53 | toJSON(github.event.issue) | semmle.label | toJSON(github.event.issue) |
232234
| .github/workflows/test.yml:8:7:10:4 | Job outputs node [job_output] | semmle.label | Job outputs node [job_output] |
233235
| .github/workflows/test.yml:8:20:8:50 | steps.step5.outputs.MSG5 | semmle.label | steps.step5.outputs.MSG5 |
234236
| .github/workflows/test.yml:12:9:18:6 | Uses Step: step0 [value] | semmle.label | Uses Step: step0 [value] |

‎ql/test/query-tests/Security/CWE-094/PrivilegedCodeInjection.expected‎

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -229,6 +229,8 @@ nodes
229229
| .github/workflows/test3.yml:11:17:11:70 | steps.issue_body_parser_request.outputs.payload | semmle.label | steps.issue_body_parser_request.outputs.payload |
230230
| .github/workflows/test3.yml:13:9:21:2 | Uses Step: issue_body_parser_request | semmle.label | Uses Step: issue_body_parser_request |
231231
| .github/workflows/test3.yml:60:27:60:66 | needs.parse-issue.outputs.payload | semmle.label | needs.parse-issue.outputs.payload |
232+
| .github/workflows/test4.yml:15:21:15:55 | toJSON(github.event.comment) | semmle.label | toJSON(github.event.comment) |
233+
| .github/workflows/test4.yml:19:21:19:53 | toJSON(github.event.issue) | semmle.label | toJSON(github.event.issue) |
232234
| .github/workflows/test.yml:8:7:10:4 | Job outputs node [job_output] | semmle.label | Job outputs node [job_output] |
233235
| .github/workflows/test.yml:8:20:8:50 | steps.step5.outputs.MSG5 | semmle.label | steps.step5.outputs.MSG5 |
234236
| .github/workflows/test.yml:12:9:18:6 | Uses Step: step0 [value] | semmle.label | Uses Step: step0 [value] |
@@ -341,6 +343,8 @@ subpaths
341343
| .github/workflows/test2.yml:27:26:27:66 | steps.changed.outputs.locale_files | .github/workflows/test2.yml:17:9:25:6 | Uses Step: changed | .github/workflows/test2.yml:27:26:27:66 | steps.changed.outputs.locale_files | Potential privileged code injection in $@, which may be controlled by an external user. | .github/workflows/test2.yml:27:26:27:66 | steps.changed.outputs.locale_files | ${{ steps.changed.outputs.locale_files }} |
342344
| .github/workflows/test2.yml:39:25:39:66 | steps.changed2.outputs.locale_files | .github/workflows/test2.yml:29:9:37:6 | Uses Step: changed2 | .github/workflows/test2.yml:39:25:39:66 | steps.changed2.outputs.locale_files | Potential privileged code injection in $@, which may be controlled by an external user. | .github/workflows/test2.yml:39:25:39:66 | steps.changed2.outputs.locale_files | ${{ steps.changed2.outputs.locale_files }} |
343345
| .github/workflows/test3.yml:60:27:60:66 | needs.parse-issue.outputs.payload | .github/workflows/test3.yml:13:9:21:2 | Uses Step: issue_body_parser_request | .github/workflows/test3.yml:60:27:60:66 | needs.parse-issue.outputs.payload | Potential privileged code injection in $@, which may be controlled by an external user. | .github/workflows/test3.yml:60:27:60:66 | needs.parse-issue.outputs.payload | ${{ needs.parse-issue.outputs.payload }} |
346+
| .github/workflows/test4.yml:15:21:15:55 | toJSON(github.event.comment) | .github/workflows/test4.yml:15:21:15:55 | toJSON(github.event.comment) | .github/workflows/test4.yml:15:21:15:55 | toJSON(github.event.comment) | Potential privileged code injection in $@, which may be controlled by an external user. | .github/workflows/test4.yml:15:21:15:55 | toJSON(github.event.comment) | ${{ toJSON(github.event.comment) }} |
347+
| .github/workflows/test4.yml:19:21:19:53 | toJSON(github.event.issue) | .github/workflows/test4.yml:19:21:19:53 | toJSON(github.event.issue) | .github/workflows/test4.yml:19:21:19:53 | toJSON(github.event.issue) | Potential privileged code injection in $@, which may be controlled by an external user. | .github/workflows/test4.yml:19:21:19:53 | toJSON(github.event.issue) | ${{ toJSON(github.event.issue) }} |
344348
| .github/workflows/test.yml:49:20:49:56 | needs.job1.outputs['job_output'] | .github/workflows/test.yml:15:20:15:64 | github.event['head_commit']['message'] | .github/workflows/test.yml:49:20:49:56 | needs.job1.outputs['job_output'] | Potential privileged code injection in $@, which may be controlled by an external user. | .github/workflows/test.yml:49:20:49:56 | needs.job1.outputs['job_output'] | ${{needs.job1.outputs['job_output']}} |
345349
| .github/workflows/workflow_run.yml:9:19:9:64 | github.event.workflow_run.display_title | .github/workflows/workflow_run.yml:9:19:9:64 | github.event.workflow_run.display_title | .github/workflows/workflow_run.yml:9:19:9:64 | github.event.workflow_run.display_title | Potential privileged code injection in $@, which may be controlled by an external user. | .github/workflows/workflow_run.yml:9:19:9:64 | github.event.workflow_run.display_title | ${{ github.event.workflow_run.display_title }} |
346350
| .github/workflows/workflow_run.yml:10:19:10:70 | github.event.workflow_run.head_commit.message | .github/workflows/workflow_run.yml:10:19:10:70 | github.event.workflow_run.head_commit.message | .github/workflows/workflow_run.yml:10:19:10:70 | github.event.workflow_run.head_commit.message | Potential privileged code injection in $@, which may be controlled by an external user. | .github/workflows/workflow_run.yml:10:19:10:70 | github.event.workflow_run.head_commit.message | ${{ github.event.workflow_run.head_commit.message }} |

0 commit comments

Comments
 (0)