Skip to content

Commit ae6856a

Browse files
author
Alvaro Muñoz
committed
models: add new control check model
1 parent 4f62573 commit ae6856a

File tree

1 file changed

+7
-0
lines changed

1 file changed

+7
-0
lines changed

ql/lib/codeql/actions/security/ControlChecks.qll

Lines changed: 7 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -267,6 +267,13 @@ class AssociationActionCheck extends AssociationCheck instanceof UsesStep {
267267

268268
class PermissionActionCheck extends PermissionCheck instanceof UsesStep {
269269
PermissionActionCheck() {
270+
this.getCallee() = "actions-cool/check-user-permission" and
271+
(
272+
// default permission level is write
273+
not exists(this.getArgument("permission-level")) or
274+
this.getArgument("require") = ["write", "admin"]
275+
)
276+
or
270277
this.getCallee() = "sushichop/action-repository-permission" and
271278
this.getArgument("required-permission") = ["write", "admin"]
272279
or

0 commit comments

Comments
 (0)