Skip to content

Commit 70d969f

Browse files
geoffw0geoffw0
committed
Merge branch 'main' into http
2 parents d723615 + bcec7ee commit 70d969f

File tree

967 files changed

+33884
-15665
lines changed

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

967 files changed

+33884
-15665
lines changed

‎.bazelrc

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -2,6 +2,9 @@ common --enable_platform_specific_config
22
# because we use --override_module with `%workspace%`, the lock file is not stable
33
common --lockfile_mode=off
44

5+
# Build release binaries by default, can be overwritten to in local.bazelrc and set to `fastbuild` or `dbg`
6+
build --compilation_mode opt
7+
58
# when building from this repository in isolation, the internal repository will not be found at ..
69
# where `MODULE.bazel` looks for it. The following will get us past the module loading phase, so
710
# that we can build things that do not rely on that

‎.github/pull_request_template.md

Lines changed: 0 additions & 14 deletions
This file was deleted.

‎actions/ql/lib/CHANGELOG.md

Lines changed: 7 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1,3 +1,10 @@
1+
## 0.4.2
2+
3+
### Bug Fixes
4+
5+
* Fixed data for vulnerable versions of `actions/download-artifact` and `rlespinasse/github-slug-action` (following GHSA-cxww-7g56-2vh6 and GHSA-6q4m-7476-932w).
6+
* Improved `untrustedGhCommandDataModel` regex for `gh pr view` and Bash taint analysis in GitHub Actions.
7+
18
## 0.4.1
29

310
No user-facing changes.

‎actions/ql/lib/change-notes/2025-01-22-version.md

Lines changed: 0 additions & 4 deletions
This file was deleted.

‎actions/ql/lib/change-notes/released/0.4.2.md

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,6 @@
1+
## 0.4.2
2+
3+
### Bug Fixes
4+
5+
* Fixed data for vulnerable versions of `actions/download-artifact` and `rlespinasse/github-slug-action` (following GHSA-cxww-7g56-2vh6 and GHSA-6q4m-7476-932w).
6+
* Improved `untrustedGhCommandDataModel` regex for `gh pr view` and Bash taint analysis in GitHub Actions.

‎actions/ql/lib/codeql-pack.release.yml

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,2 +1,2 @@
11
---
2-
lastReleaseVersion: 0.4.1
2+
lastReleaseVersion: 0.4.2

‎actions/ql/lib/codeql/actions/Bash.qll

Lines changed: 13 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -695,6 +695,19 @@ module Bash {
695695
not varMatchesRegexTest(script, var2, alphaNumericRegex())
696696
)
697697
or
698+
exists(string var2, string value2, string var3, string value3 |
699+
// VAR2=$(cmd)
700+
// VAR3=$VAR2
701+
// echo "FIELD=${VAR3:-default}" >> $GITHUB_ENV (field, file_write_value)
702+
containsCmdSubstitution(value2, cmd) and
703+
script.getAnAssignment(var2, value2) and
704+
containsParameterExpansion(value3, var2, _, _) and
705+
script.getAnAssignment(var3, value3) and
706+
containsParameterExpansion(expr, var3, _, _) and
707+
not varMatchesRegexTest(script, var2, alphaNumericRegex()) and
708+
not varMatchesRegexTest(script, var3, alphaNumericRegex())
709+
)
710+
or
698711
// var reaches the file write directly
699712
// echo "FIELD=$(cmd)" >> $GITHUB_ENV (field, file_write_value)
700713
containsCmdSubstitution(expr, cmd)

‎actions/ql/lib/ext/config/untrusted_gh_command.yml

Lines changed: 12 additions & 9 deletions
Original file line numberDiff line numberDiff line change
@@ -7,26 +7,29 @@ extensions:
77
# PULL REQUESTS
88
#
99
# HEAD_REF=$(gh pr view "${{ github.event.issue.number }}" --json headRefName -q '.headRefName')
10-
- ["gh\\s+pr\\b.*\\bview\\b.*\\.headRefName.*", "branch,oneline"]
10+
- ["gh\\s+pr\\b.*\\bview\\b.*\\bheadRefName\\b", "branch,oneline"]
1111
# TITLE=$(gh pr view $PR_NUMBER --json title --jq .title)
12-
- ["gh\\s+pr\\b.*\\bview\\b.*\\.title.*", "title,oneline"]
12+
# TITLE=$(gh pr view $PR_NUMBER --json "title")
13+
- ["gh\\s+pr\\b.*\\bview\\b.*\\btitle\\b", "title,oneline"]
1314
# BODY=$(gh pr view $PR_NUMBER --json body --jq .body)
14-
- ["gh\\s+pr\\b.*\\bview\\b.*\\.body.*", "text,multiline"]
15+
- ["gh\\s+pr\\b.*\\bview\\b.*\\bbody\\b", "text,multiline"]
1516
# COMMENTS="$(gh pr view --repo ${{ github.repository }} "$PR_NUMBER" --json "body,comments" -q '.body, .comments[].body')"
16-
- ["gh\\s+pr\\b.*\\bview\\b.*\\.comments.*", "text,multiline"]
17+
- ["gh\\s+pr\\b.*\\bview\\b.*\\bcomments\\b", "text,multiline"]
1718
# CHANGED_FILES="$(gh pr view --repo ${{ github.repository }} ${{ needs.check-comment.outputs.pull_number }} --json files --jq '.files.[].path')"
18-
- ["gh\\s+pr\\b.*\\bview\\b.*\\.files.*", "filename,multiline"]
19+
- ["gh\\s+pr\\b.*\\bview\\b.*\\bfiles\\b", "filename,multiline"]
1920
# AUTHOR=$(gh pr view ${ORI_PR} -R ${REPO} --json author -q '.author.login')
20-
- ["gh\\s+pr\\b.*\\bview\\b.*\\.author.*", "username,oneline"]
21+
- ["gh\\s+pr\\b.*\\bview\\b.*\\bauthor\\b", "username,oneline"]
2122
#
2223
# ISSUES
2324
#
2425
# TITLE=$(gh issue view "$ISSUE_NUMBER" --json title --jq '.title')
25-
- ["gh\\s+issue\\b.*\\bview\\b.*\\.title.*", "title,oneline"]
26+
# TITLE=$(gh issue view "$ISSUE_NUMBER" --json title,body)
27+
# TITLE=$(gh issue view "$ISSUE_NUMBER" --json "title,body")
28+
- ["gh\\s+issue\\b.*\\bview\\b.*\\btitle\\b", "title,oneline"]
2629
# BODY=$(gh issue view -R ${GITHUB_REPOSITORY} ${ORIGINAL_ISSUE_NUMBER} --json title,body,assignees --jq .body)
27-
- ["gh\\s+issue\\b.*\\bview\\b.*\\.body.*", "text,multiline"]
30+
- ["gh\\s+issue\\b.*\\bview\\b.*\\bbody\\b", "text,multiline"]
2831
# COMMENTS=$(gh issue view "$ISSUE_NUMBER" --json comments --jq '.comments[].body')
29-
- ["gh\\s+issue\\b.*\\bview\\b.*\\.comments.*", "text,multiline"]
32+
- ["gh\\s+issue\\b.*\\bview\\b.*\\bcomments\\b", "text,multiline"]
3033
#
3134
# API
3235
#

‎actions/ql/lib/qlpack.yml

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,5 @@
11
name: codeql/actions-all
2-
version: 0.4.2-dev
2+
version: 0.4.3-dev
33
library: true
44
warnOnImplicitThis: true
55
dependencies:

‎actions/ql/src/CHANGELOG.md

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1,3 +1,7 @@
1+
## 0.4.2
2+
3+
No user-facing changes.
4+
15
## 0.4.1
26

37
No user-facing changes.

0 commit comments

Comments
 (0)