Merge remote-tracking branch 'upstream/main' into igfoo/mb · jacknojo/codeql@dcd0a69 · GitHub
Skip to content

Commit dcd0a69

Browse files
igfooigfoo
committed
Merge remote-tracking branch 'upstream/main' into igfoo/mb
2 parents 70cc153 + c666fc7 commit dcd0a69

1,891 files changed

Lines changed: 158537 additions & 95024 deletions

File tree

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

‎.bazelversion‎

Lines changed: 1 addition & 1 deletion

‎.github/dependabot.yml‎

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -40,3 +40,8 @@ updates:
4040
- dependency-name: "*"
4141
reviewers:
4242
- "github/codeql-go"
43+
44+
- package-ecosystem: bazel
45+
directory: "/"
46+
schedule:
47+
interval: weekly

‎.github/workflows/codeql-analysis.yml‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -34,7 +34,7 @@ jobs:
3434
- name: Setup dotnet
3535
uses: actions/setup-dotnet@v4
3636
with:
37-
dotnet-version: 9.0.300
37+
dotnet-version: 10.0.100
3838

3939
- name: Checkout repository
4040
uses: actions/checkout@v5

‎.github/workflows/csharp-qltest.yml‎

Lines changed: 5 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -43,14 +43,14 @@ jobs:
4343
- name: Setup dotnet
4444
uses: actions/setup-dotnet@v4
4545
with:
46-
dotnet-version: 9.0.300
46+
dotnet-version: 10.0.100
4747
- name: Extractor unit tests
4848
run: |
4949
dotnet tool restore
50-
dotnet test -p:RuntimeFrameworkVersion=9.0.5 extractor/Semmle.Util.Tests
51-
dotnet test -p:RuntimeFrameworkVersion=9.0.5 extractor/Semmle.Extraction.Tests
52-
dotnet test -p:RuntimeFrameworkVersion=9.0.5 autobuilder/Semmle.Autobuild.CSharp.Tests
53-
dotnet test -p:RuntimeFrameworkVersion=9.0.5 autobuilder/Semmle.Autobuild.Cpp.Tests
50+
dotnet test -p:RuntimeFrameworkVersion=10.0.0 extractor/Semmle.Util.Tests
51+
dotnet test -p:RuntimeFrameworkVersion=10.0.0 extractor/Semmle.Extraction.Tests
52+
dotnet test -p:RuntimeFrameworkVersion=10.0.0 autobuilder/Semmle.Autobuild.CSharp.Tests
53+
dotnet test -p:RuntimeFrameworkVersion=10.0.0 autobuilder/Semmle.Autobuild.Cpp.Tests
5454
shell: bash
5555
stubgentest:
5656
runs-on: ubuntu-latest

‎MODULE.bazel‎

Lines changed: 7 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -26,7 +26,7 @@ bazel_dep(name = "nlohmann_json", version = "3.11.3", repo_name = "json")
2626
bazel_dep(name = "fmt", version = "12.1.0-codeql.1")
2727
bazel_dep(name = "rules_kotlin", version = "2.1.3-codeql.1")
2828
bazel_dep(name = "gazelle", version = "0.40.0")
29-
bazel_dep(name = "rules_dotnet", version = "0.19.2-codeql.1")
29+
bazel_dep(name = "rules_dotnet", version = "0.21.5-codeql.1")
3030
bazel_dep(name = "googletest", version = "1.14.0.bcr.1")
3131
bazel_dep(name = "rules_rust", version = "0.66.0")
3232
bazel_dep(name = "zstd", version = "1.5.5.bcr.1")
@@ -172,7 +172,7 @@ http_archive(
172172
)
173173

174174
dotnet = use_extension("@rules_dotnet//dotnet:extensions.bzl", "dotnet")
175-
dotnet.toolchain(dotnet_version = "9.0.300")
175+
dotnet.toolchain(dotnet_version = "10.0.100")
176176
use_repo(dotnet, "dotnet_toolchains")
177177

178178
register_toolchains("@dotnet_toolchains//:all")
@@ -274,11 +274,11 @@ ripunzip_archive = use_repo_rule("//misc/ripunzip:ripunzip.bzl", "ripunzip_archi
274274
# go to https://github.com/GoogleChrome/ripunzip/releases to find latest version and corresponding sha256s
275275
ripunzip_archive(
276276
name = "ripunzip",
277-
sha256_linux = "ee0e8a957687a5dc3a66b2a4b25883bf762df4c9c07f0651af527a32a405054b",
278-
sha256_macos_arm = "8a88eea54eac232d162a72a42065e0429b82dbf4f05e9642915dff9d7a81f846",
279-
sha256_macos_intel = "4457a18bfcc5feabe09f5ea3d1157128e07b4873392cb404a870e611924abf64",
280-
sha256_windows = "66d0c1375301bf5ab815348048f43b110631d3fa7200acd50d50a8ed8655ca62",
281-
version = "2.0.3",
277+
sha256_linux = "71482d7a7e4ea9176d5596161c49250c34b136b157c45f632b1111323fbfc0de",
278+
sha256_macos_arm = "604194ab13f0aba3972995d995f11002b8fc285c8170401fcd46655065df20c9",
279+
sha256_macos_intel = "65367b94fd579d93d46f2d2595cc4c9a60cfcf497e3c824f9d1a7b80fa8bd38a",
280+
sha256_windows = "ac3874075def2b9e5074a3b5945005ab082cc6e689e1de658da8965bc23e643e",
281+
version = "2.0.4",
282282
)
283283

284284
register_toolchains(

‎actions/ql/lib/change-notes/2025-11-28-fix-code-injection-alert-filtering.md‎

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,4 @@
1+
---
2+
category: majorAnalysis
3+
---
4+
* The query `actions/code-injection/medium` has been updated to include results which were incorrectly excluded while filtering out results that are reported by `actions/code-injection/critical`.

‎actions/ql/lib/codeql/actions/security/CodeInjectionQuery.qll‎

Lines changed: 36 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -19,12 +19,7 @@ class CodeInjectionSink extends DataFlow::Node {
1919
Event getRelevantCriticalEventForSink(DataFlow::Node sink) {
2020
inPrivilegedContext(sink.asExpr(), result) and
2121
not exists(ControlCheck check | check.protects(sink.asExpr(), result, "code-injection")) and
22-
// exclude cases where the sink is a JS script and the expression uses toJson
23-
not exists(UsesStep script |
24-
script.getCallee() = "actions/github-script" and
25-
script.getArgumentExpr("script") = sink.asExpr() and
26-
exists(getAToJsonReferenceExpression(sink.asExpr().(Expression).getExpression(), _))
27-
)
22+
not isGithubScriptUsingToJson(sink.asExpr())
2823
}
2924

3025
/**
@@ -91,3 +86,38 @@ private module CodeInjectionConfig implements DataFlow::ConfigSig {
9186

9287
/** Tracks flow of unsafe user input that is used to construct and evaluate a code script. */
9388
module CodeInjectionFlow = TaintTracking::Global<CodeInjectionConfig>;
89+
90+
/**
91+
* Holds if there is a code injection flow from `source` to `sink` with
92+
* critical severity, linked by `event`.
93+
*/
94+
predicate criticalSeverityCodeInjection(
95+
CodeInjectionFlow::PathNode source, CodeInjectionFlow::PathNode sink, Event event
96+
) {
97+
CodeInjectionFlow::flowPath(source, sink) and
98+
event = getRelevantCriticalEventForSink(sink.getNode()) and
99+
source.getNode().(RemoteFlowSource).getEventName() = event.getName()
100+
}
101+
102+
/**
103+
* Holds if there is a code injection flow from `source` to `sink` with medium severity.
104+
*/
105+
predicate mediumSeverityCodeInjection(
106+
CodeInjectionFlow::PathNode source, CodeInjectionFlow::PathNode sink
107+
) {
108+
CodeInjectionFlow::flowPath(source, sink) and
109+
not criticalSeverityCodeInjection(source, sink, _) and
110+
not isGithubScriptUsingToJson(sink.getNode().asExpr())
111+
}
112+
113+
/**
114+
* Holds if `expr` is the `script` input to `actions/github-script` and it uses
115+
* `toJson`.
116+
*/
117+
predicate isGithubScriptUsingToJson(Expression expr) {
118+
exists(UsesStep script |
119+
script.getCallee() = "actions/github-script" and
120+
script.getArgumentExpr("script") = expr and
121+
exists(getAToJsonReferenceExpression(expr.getExpression(), _))
122+
)
123+
}

‎actions/ql/src/Security/CWE-094/CodeInjectionCritical.ql‎

Lines changed: 1 addition & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -20,10 +20,7 @@ import CodeInjectionFlow::PathGraph
2020
import codeql.actions.security.ControlChecks
2121

2222
from CodeInjectionFlow::PathNode source, CodeInjectionFlow::PathNode sink, Event event
23-
where
24-
CodeInjectionFlow::flowPath(source, sink) and
25-
event = getRelevantCriticalEventForSink(sink.getNode()) and
26-
source.getNode().(RemoteFlowSource).getEventName() = event.getName()
23+
where criticalSeverityCodeInjection(source, sink, event)
2724
select sink.getNode(), source, sink,
2825
"Potential code injection in $@, which may be controlled by an external user ($@).", sink,
2926
sink.getNode().asExpr().(Expression).getRawExpression(), event, event.getName()

‎actions/ql/src/Security/CWE-094/CodeInjectionMedium.ql‎

Lines changed: 1 addition & 9 deletions
Original file line numberDiff line numberDiff line change
@@ -19,15 +19,7 @@ import codeql.actions.security.CodeInjectionQuery
1919
import CodeInjectionFlow::PathGraph
2020

2121
from CodeInjectionFlow::PathNode source, CodeInjectionFlow::PathNode sink
22-
where
23-
CodeInjectionFlow::flowPath(source, sink) and
24-
inNonPrivilegedContext(sink.getNode().asExpr()) and
25-
// exclude cases where the sink is a JS script and the expression uses toJson
26-
not exists(UsesStep script |
27-
script.getCallee() = "actions/github-script" and
28-
script.getArgumentExpr("script") = sink.getNode().asExpr() and
29-
exists(getAToJsonReferenceExpression(sink.getNode().asExpr().(Expression).getExpression(), _))
30-
)
22+
where mediumSeverityCodeInjection(source, sink)
3123
select sink.getNode(), source, sink,
3224
"Potential code injection in $@, which may be controlled by an external user.", sink,
3325
sink.getNode().asExpr().(Expression).getRawExpression()

‎actions/ql/src/Security/CWE-275/MissingActionsPermissions.md‎

Lines changed: 2 additions & 0 deletions

0 commit comments

Comments
 (0)