Skip to content

Commit fc38bf0

Browse files
erik-krogherik-krogh
committed
Merge branch 'main' into aliasFlow
2 parents dcdff7a + b8e1aa6 commit fc38bf0

File tree

3,520 files changed

+128170
-107644
lines changed

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

3,520 files changed

+128170
-107644
lines changed

‎.github/actions/fetch-codeql/action.yml

Lines changed: 11 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -1,14 +1,22 @@
11
name: Fetch CodeQL
22
description: Fetches the latest version of CodeQL
3+
4+
inputs:
5+
channel:
6+
description: 'The CodeQL channel to use'
7+
required: false
8+
default: 'nightly'
9+
310
runs:
411
using: composite
512
steps:
613
- name: Fetch CodeQL
714
shell: bash
15+
env:
16+
GITHUB_TOKEN: ${{ github.token }}
17+
CHANNEL: ${{ inputs.channel }}
818
run: |
919
gh extension install github/gh-codeql
10-
gh codeql set-channel nightly
20+
gh codeql set-channel "$CHANNEL"
1121
gh codeql version
1222
gh codeql version --format=json | jq -r .unpackedLocation >> "${GITHUB_PATH}"
13-
env:
14-
GITHUB_TOKEN: ${{ github.token }}

‎.github/labeler.yml

Lines changed: 11 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -43,3 +43,14 @@ documentation:
4343
"QL-for-QL":
4444
- ql/**/*
4545
- .github/workflows/ql-for-ql*
46+
47+
# Since these are all shared files that need to be synced, just pick _one_ copy of each.
48+
"DataFlow Library":
49+
- "java/ql/lib/semmle/code/java/dataflow/internal/DataFlowImpl.qll"
50+
- "java/ql/lib/semmle/code/java/dataflow/internal/DataFlowImplCommon.qll"
51+
- "java/ql/lib/semmle/code/java/dataflow/internal/tainttracking1/TaintTrackingImpl.qll"
52+
- "java/ql/lib/semmle/code/java/dataflow/internal/DataFlowImplConsistency.qll"
53+
- "java/ql/lib/semmle/code/java/dataflow/internal/FlowSummaryImpl.qll"
54+
55+
"ATM":
56+
- javascript/ql/experimental/adaptivethreatmodeling/**/*

‎.github/workflows/atm-check-query-suite.yml

Lines changed: 93 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,93 @@
1+
name: "ATM - Check query suite"
2+
3+
env:
4+
QUERY_PACK: javascript/ql/experimental/adaptivethreatmodeling/src
5+
QUERY_SUITE: codeql-suites/javascript-atm-code-scanning.qls
6+
7+
on:
8+
pull_request:
9+
paths:
10+
- ".github/workflows/atm-check-query-suite.yml"
11+
- "javascript/ql/experimental/adaptivethreatmodeling/**"
12+
workflow_dispatch:
13+
14+
jobs:
15+
atm-check-query-suite:
16+
runs-on: ubuntu-latest
17+
18+
steps:
19+
- uses: actions/checkout@v3
20+
21+
- name: Setup CodeQL
22+
uses: ./.github/actions/fetch-codeql
23+
with:
24+
channel: release
25+
26+
- name: Install ATM model
27+
run: |
28+
set -exu
29+
30+
# Install dependencies of ATM query pack, i.e. the ATM model
31+
codeql pack install "${QUERY_PACK}"
32+
33+
# Retrieve model checksum
34+
model_checksum=$(codeql resolve extensions "${QUERY_PACK}/${QUERY_SUITE}" | jq -r '.models[0].checksum')
35+
36+
# Trust the model so that we can use it in the ATM boosted queries
37+
mkdir -p "$HOME/.config/codeql"
38+
echo "--insecurely-execute-ml-model-checksums ${model_checksum}" >> "$HOME/.config/codeql/config"
39+
40+
- name: Create test DB
41+
run: |
42+
DB_PATH="${RUNNER_TEMP}/db"
43+
echo "DB_PATH=${DB_PATH}" >> "${GITHUB_ENV}"
44+
45+
codeql database create "${DB_PATH}" --source-root config/atm --language javascript
46+
47+
- name: Run ATM query suite
48+
run: |
49+
SARIF_PATH="${RUNNER_TEMP}/sarif.json"
50+
echo "SARIF_PATH=${SARIF_PATH}" >> "${GITHUB_ENV}"
51+
52+
codeql database analyze \
53+
--format sarif-latest \
54+
--output "${SARIF_PATH}" \
55+
--sarif-group-rules-by-pack \
56+
-vv \
57+
-- \
58+
"${DB_PATH}" \
59+
"${QUERY_PACK}/${QUERY_SUITE}"
60+
61+
- name: Upload SARIF
62+
uses: actions/upload-artifact@v3
63+
with:
64+
name: javascript-ml-powered-queries.sarif
65+
path: "${{ env.SARIF_PATH }}"
66+
retention-days: 5
67+
68+
- name: Check results
69+
run: |
70+
# We should run at least the ML-powered queries in `expected_rules`.
71+
expected_rules="js/ml-powered/nosql-injection js/ml-powered/path-injection js/ml-powered/sql-injection js/ml-powered/xss"
72+
73+
for rule in ${expected_rules}; do
74+
found_rule=$(jq --arg rule "${rule}" '[.runs[0].tool.extensions[].rules | select(. != null) |
75+
flatten | .[].id] | any(. == $rule)' "${SARIF_PATH}")
76+
if [[ "${found_rule}" != "true" ]]; then
77+
echo "Expected SARIF output to contain rule '${rule}', but found no such rule."
78+
exit 1
79+
else
80+
echo "Found rule '${rule}'."
81+
fi
82+
done
83+
84+
# We should have at least one alert from an ML-powered query.
85+
num_alerts=$(jq '[.runs[0].results[] |
86+
select(.properties.score != null and (.rule.id | startswith("js/ml-powered/")))] | length' \
87+
"${SARIF_PATH}")
88+
if [[ "${num_alerts}" -eq 0 ]]; then
89+
echo "Expected to find at least one alert from an ML-powered query but found ${num_alerts}."
90+
exit 1
91+
else
92+
echo "Found ${num_alerts} alerts from ML-powered queries.";
93+
fi

‎.github/workflows/atm-model-integration-tests.yml

Lines changed: 12 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,12 @@
1+
name: ATM Model Integration Tests
2+
3+
on:
4+
workflow_dispatch:
5+
6+
jobs:
7+
hello-world:
8+
runs-on: ubuntu-latest
9+
10+
steps:
11+
- name: foo
12+
run: echo "Hello world"

‎.github/workflows/compile-queries.yml

Lines changed: 57 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,57 @@
1+
name: "Compile all queries using the latest stable CodeQL CLI"
2+
3+
on:
4+
push:
5+
branches: [main] # makes sure the cache gets populated
6+
pull_request:
7+
branches:
8+
- main
9+
- "rc/*"
10+
11+
jobs:
12+
compile-queries:
13+
runs-on: ubuntu-latest-xl
14+
15+
steps:
16+
- uses: actions/checkout@v3
17+
with:
18+
fetch-depth: 0
19+
# calculate the merge-base with main, in a way that works both on PRs and pushes to main.
20+
- name: Calculate merge-base
21+
if: ${{ github.event_name == 'pull_request' }}
22+
env:
23+
BASE_BRANCH: ${{ github.base_ref }}
24+
run: |
25+
MERGE_BASE=$(git merge-base --fork-point origin/$BASE_BRANCH)
26+
echo "merge-base=$MERGE_BASE" >> $GITHUB_ENV
27+
- name: Calculate merge-base - branch
28+
if: ${{ github.event_name != 'pull_request' }}
29+
# using github.sha instead, since we're directly on a branch, and not in a PR
30+
run: |
31+
MERGE_BASE=${{ github.sha }}
32+
echo "merge-base=$MERGE_BASE" >> $GITHUB_ENV
33+
- name: Cache CodeQL query compilation
34+
uses: actions/cache@v3
35+
with:
36+
path: '*/ql/src/.cache'
37+
# current GH HEAD first, merge-base second, generic third
38+
key: codeql-stable-compile-${{ github.sha }}
39+
restore-keys: |
40+
codeql-stable-compile-${{ env.merge-base }}
41+
codeql-stable-compile-
42+
- name: Setup CodeQL
43+
uses: ./.github/actions/fetch-codeql
44+
with:
45+
channel: 'release'
46+
- name: check formatting
47+
run: codeql query format */ql/{src,lib,test}/**/*.{qll,ql} --check-only
48+
- name: compile queries - check-only
49+
# run with --check-only if running in a PR (github.sha != main)
50+
if : ${{ github.event_name == 'pull_request' }}
51+
shell: bash
52+
run: codeql query compile -j0 */ql/src --keep-going --warnings=error --check-only
53+
- name: compile queries - full
54+
# do full compile if running on main - this populates the cache
55+
if : ${{ github.event_name != 'pull_request' }}
56+
shell: bash
57+
run: codeql query compile -j0 */ql/src --keep-going --warnings=error

‎.github/workflows/go-tests.yml

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -43,7 +43,7 @@ jobs:
4343
env QHELP_OUT_DIR=qhelp-out make qhelp-to-markdown
4444
4545
- name: Upload qhelp markdown
46-
uses: actions/upload-artifact@v2
46+
uses: actions/upload-artifact@v3
4747
with:
4848
name: qhelp-markdown
4949
path: go/qhelp-out/**/*.md

‎.github/workflows/qhelp-pr-preview.yml

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -27,7 +27,7 @@ on:
2727
- main
2828
- "rc/*"
2929
paths:
30-
- "ruby/**/*.qhelp"
30+
- "**/*.qhelp"
3131

3232
jobs:
3333
qhelp:
@@ -52,7 +52,7 @@ jobs:
5252
id: changes
5353
run: |
5454
(git diff -z --name-only --diff-filter=ACMRT HEAD~1 HEAD | grep -z '.qhelp$' | grep -z -v '.inc.qhelp';
55-
git diff -z --name-only --diff-filter=ACMRT HEAD~1 HEAD | grep -z '.inc.qhelp$' | xargs --null -rn1 basename | xargs --null -rn1 git grep -z -l) |
55+
git diff -z --name-only --diff-filter=ACMRT HEAD~1 HEAD | grep -z '.inc.qhelp$' | xargs --null -rn1 basename -z | xargs --null -rn1 git grep -z -l) |
5656
grep -z '.qhelp$' | grep -z -v '^-' | sort -z -u > "${RUNNER_TEMP}/paths.txt"
5757
5858
- name: QHelp preview

‎.github/workflows/ruby-build.yml

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -96,8 +96,8 @@ jobs:
9696
- name: Build Query Pack
9797
run: |
9898
codeql pack create ../shared/ssa --output target/packs
99+
codeql pack create ../misc/suite-helpers --output target/packs
99100
codeql pack create ql/lib --output target/packs
100-
codeql pack install ql/src
101101
codeql pack create ql/src --output target/packs
102102
PACK_FOLDER=$(readlink -f target/packs/codeql/ruby-queries/*)
103103
codeql generate query-help --format=sarifv2.1.0 --output="${PACK_FOLDER}/rules.sarif" ql/src
@@ -202,7 +202,7 @@ jobs:
202202
echo 'name: sample-tests
203203
version: 0.0.0
204204
dependencies:
205-
codeql/ruby-all: 0.0.1
205+
codeql/ruby-all: "*"
206206
extractor: ruby
207207
tests: .
208208
' > qlpack.yml

‎.github/workflows/swift-codegen.yml

Lines changed: 0 additions & 39 deletions
This file was deleted.

‎.github/workflows/swift-integration-tests.yml

Lines changed: 0 additions & 45 deletions
This file was deleted.

0 commit comments

Comments
 (0)