Skip to content

Navigation Menu

Sign in
Appearance settings

Search code, repositories, users, issues, pull requests...

Provide feedback

We read every piece of feedback, and take your input very seriously.

Saved searches

Use saved searches to filter your results more quickly
Appearance settings

Commit 12bf31e

Browse filesBrowse files
asgerfasgerf
committed
Actions: mass enable diff-informed data flow
1 parent 772b972 commit 12bf31e
Copy full SHA for 12bf31e
Expand file treeCollapse file tree

16 files changed

+42
-0
lines changed

‎actions/ql/lib/codeql/actions/security/ArgumentInjectionQuery.qll

Copy file name to clipboardExpand all lines: actions/ql/lib/codeql/actions/security/ArgumentInjectionQuery.qll
+2Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -88,6 +88,8 @@ private module ArgumentInjectionConfig implements DataFlow::ConfigSig {
8888
run.getScript().getAnEnvReachingArgumentInjectionSink(var, _, _)
8989
)
9090
}
91+
92+
predicate observeDiffInformedIncrementalMode() { any() }
9193
}
9294

9395
/** Tracks flow of unsafe user input that is used to construct and evaluate a code script. */

‎actions/ql/lib/codeql/actions/security/ArtifactPoisoningQuery.qll

Copy file name to clipboardExpand all lines: actions/ql/lib/codeql/actions/security/ArtifactPoisoningQuery.qll
+2Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -316,6 +316,8 @@ private module ArtifactPoisoningConfig implements DataFlow::ConfigSig {
316316
exists(run.getScript().getAFileReadCommand())
317317
)
318318
}
319+
320+
predicate observeDiffInformedIncrementalMode() { any() }
319321
}
320322

321323
/** Tracks flow of unsafe artifacts that is used in an insecure way. */

‎actions/ql/lib/codeql/actions/security/CodeInjectionQuery.qll

Copy file name to clipboardExpand all lines: actions/ql/lib/codeql/actions/security/CodeInjectionQuery.qll
+2Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -35,6 +35,8 @@ private module CodeInjectionConfig implements DataFlow::ConfigSig {
3535
exists(run.getScript().getAFileReadCommand())
3636
)
3737
}
38+
39+
predicate observeDiffInformedIncrementalMode() { any() }
3840
}
3941

4042
/** Tracks flow of unsafe user input that is used to construct and evaluate a code script. */

‎actions/ql/lib/codeql/actions/security/CommandInjectionQuery.qll

Copy file name to clipboardExpand all lines: actions/ql/lib/codeql/actions/security/CommandInjectionQuery.qll
+2Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -16,6 +16,8 @@ private module CommandInjectionConfig implements DataFlow::ConfigSig {
1616
predicate isSource(DataFlow::Node source) { source instanceof RemoteFlowSource }
1717

1818
predicate isSink(DataFlow::Node sink) { sink instanceof CommandInjectionSink }
19+
20+
predicate observeDiffInformedIncrementalMode() { any() }
1921
}
2022

2123
/** Tracks flow of unsafe user input that is used to construct and evaluate a system command. */

‎actions/ql/lib/codeql/actions/security/EnvPathInjectionQuery.qll

Copy file name to clipboardExpand all lines: actions/ql/lib/codeql/actions/security/EnvPathInjectionQuery.qll
+2Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -108,6 +108,8 @@ private module EnvPathInjectionConfig implements DataFlow::ConfigSig {
108108
exists(run.getScript().getAFileReadCommand())
109109
)
110110
}
111+
112+
predicate observeDiffInformedIncrementalMode() { any() }
111113
}
112114

113115
/** Tracks flow of unsafe user input that is used to construct and evaluate the PATH environment variable. */

‎actions/ql/lib/codeql/actions/security/EnvVarInjectionQuery.qll

Copy file name to clipboardExpand all lines: actions/ql/lib/codeql/actions/security/EnvVarInjectionQuery.qll
+2Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -163,6 +163,8 @@ private module EnvVarInjectionConfig implements DataFlow::ConfigSig {
163163
exists(run.getScript().getAFileReadCommand())
164164
)
165165
}
166+
167+
predicate observeDiffInformedIncrementalMode() { any() }
166168
}
167169

168170
/** Tracks flow of unsafe user input that is used to construct and evaluate an environment variable. */

‎actions/ql/lib/codeql/actions/security/OutputClobberingQuery.qll

Copy file name to clipboardExpand all lines: actions/ql/lib/codeql/actions/security/OutputClobberingQuery.qll
+2Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -214,6 +214,8 @@ private module OutputClobberingConfig implements DataFlow::ConfigSig {
214214
)
215215
)
216216
}
217+
218+
predicate observeDiffInformedIncrementalMode() { any() }
217219
}
218220

219221
/** Tracks flow of unsafe user input that is used to construct and evaluate an environment variable. */

‎actions/ql/lib/codeql/actions/security/RequestForgeryQuery.qll

Copy file name to clipboardExpand all lines: actions/ql/lib/codeql/actions/security/RequestForgeryQuery.qll
+2Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -16,6 +16,8 @@ private module RequestForgeryConfig implements DataFlow::ConfigSig {
1616
predicate isSource(DataFlow::Node source) { source instanceof RemoteFlowSource }
1717

1818
predicate isSink(DataFlow::Node sink) { sink instanceof RequestForgerySink }
19+
20+
predicate observeDiffInformedIncrementalMode() { any() }
1921
}
2022

2123
/** Tracks flow of unsafe user input that is used to construct and evaluate a system command. */

‎actions/ql/lib/codeql/actions/security/SecretExfiltrationQuery.qll

Copy file name to clipboardExpand all lines: actions/ql/lib/codeql/actions/security/SecretExfiltrationQuery.qll
+2Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -15,6 +15,8 @@ private module SecretExfiltrationConfig implements DataFlow::ConfigSig {
1515
predicate isSource(DataFlow::Node source) { source instanceof RemoteFlowSource }
1616

1717
predicate isSink(DataFlow::Node sink) { sink instanceof SecretExfiltrationSink }
18+
19+
predicate observeDiffInformedIncrementalMode() { any() }
1820
}
1921

2022
/** Tracks flow of unsafe user input that is used in a context where it may lead to a secret exfiltration. */

‎actions/ql/lib/codeql/actions/security/UntrustedCheckoutQuery.qll

Copy file name to clipboardExpand all lines: actions/ql/lib/codeql/actions/security/UntrustedCheckoutQuery.qll
+12Lines changed: 12 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -70,6 +70,12 @@ private module ActionsMutableRefCheckoutConfig implements DataFlow::ConfigSig {
7070
exists(run.getScript().getAFileReadCommand())
7171
)
7272
}
73+
74+
predicate observeDiffInformedIncrementalMode() {
75+
// TODO(diff-informed): Manually verify if config can be diff-informed.
76+
// actions/ql/lib/codeql/actions/security/UntrustedCheckoutQuery.qll:238: Flow call outside 'select' clause
77+
none()
78+
}
7379
}
7480

7581
module ActionsMutableRefCheckoutFlow = TaintTracking::Global<ActionsMutableRefCheckoutConfig>;
@@ -121,6 +127,12 @@ private module ActionsSHACheckoutConfig implements DataFlow::ConfigSig {
121127
exists(run.getScript().getAFileReadCommand())
122128
)
123129
}
130+
131+
predicate observeDiffInformedIncrementalMode() {
132+
// TODO(diff-informed): Manually verify if config can be diff-informed.
133+
// actions/ql/lib/codeql/actions/security/UntrustedCheckoutQuery.qll:273: Flow call outside 'select' clause
134+
none()
135+
}
124136
}
125137

126138
module ActionsSHACheckoutFlow = TaintTracking::Global<ActionsSHACheckoutConfig>;

‎actions/ql/src/Models/CompositeActionsSinks.ql

Copy file name to clipboardExpand all lines: actions/ql/src/Models/CompositeActionsSinks.ql
+2Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -24,6 +24,8 @@ private module MyConfig implements DataFlow::ConfigSig {
2424
predicate isSink(DataFlow::Node sink) {
2525
sink instanceof CodeInjectionSink and not madSink(sink, "code-injection")
2626
}
27+
28+
predicate observeDiffInformedIncrementalMode() { any() }
2729
}
2830

2931
module MyFlow = TaintTracking::Global<MyConfig>;

‎actions/ql/src/Models/CompositeActionsSources.ql

Copy file name to clipboardExpand all lines: actions/ql/src/Models/CompositeActionsSources.ql
+2Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -34,6 +34,8 @@ private module MyConfig implements DataFlow::ConfigSig {
3434
isSink(node) and
3535
set instanceof DataFlow::FieldContent
3636
}
37+
38+
predicate observeDiffInformedIncrementalMode() { any() }
3739
}
3840

3941
module MyFlow = TaintTracking::Global<MyConfig>;

‎actions/ql/src/Models/CompositeActionsSummaries.ql

Copy file name to clipboardExpand all lines: actions/ql/src/Models/CompositeActionsSummaries.ql
+2Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -25,6 +25,8 @@ private module MyConfig implements DataFlow::ConfigSig {
2525
predicate isSink(DataFlow::Node sink) {
2626
exists(CompositeAction c | c.getAnOutputExpr() = sink.asExpr())
2727
}
28+
29+
predicate observeDiffInformedIncrementalMode() { any() }
2830
}
2931

3032
module MyFlow = TaintTracking::Global<MyConfig>;

‎actions/ql/src/Models/ReusableWorkflowsSinks.ql

Copy file name to clipboardExpand all lines: actions/ql/src/Models/ReusableWorkflowsSinks.ql
+2Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -24,6 +24,8 @@ private module MyConfig implements DataFlow::ConfigSig {
2424
predicate isSink(DataFlow::Node sink) {
2525
sink instanceof CodeInjectionSink and not madSink(sink, "code-injection")
2626
}
27+
28+
predicate observeDiffInformedIncrementalMode() { any() }
2729
}
2830

2931
module MyFlow = TaintTracking::Global<MyConfig>;

‎actions/ql/src/Models/ReusableWorkflowsSources.ql

Copy file name to clipboardExpand all lines: actions/ql/src/Models/ReusableWorkflowsSources.ql
+2Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -34,6 +34,8 @@ private module MyConfig implements DataFlow::ConfigSig {
3434
isSink(node) and
3535
set instanceof DataFlow::FieldContent
3636
}
37+
38+
predicate observeDiffInformedIncrementalMode() { any() }
3739
}
3840

3941
module MyFlow = TaintTracking::Global<MyConfig>;

‎actions/ql/src/Models/ReusableWorkflowsSummaries.ql

Copy file name to clipboardExpand all lines: actions/ql/src/Models/ReusableWorkflowsSummaries.ql
+2Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -25,6 +25,8 @@ private module MyConfig implements DataFlow::ConfigSig {
2525
predicate isSink(DataFlow::Node sink) {
2626
exists(ReusableWorkflow w | w.getAnOutputExpr() = sink.asExpr())
2727
}
28+
29+
predicate observeDiffInformedIncrementalMode() { any() }
2830
}
2931

3032
module MyFlow = TaintTracking::Global<MyConfig>;

0 commit comments

Comments
0 (0)
Morty Proxy This is a proxified and sanitized view of the page, visit original site.