Skip to content

Commit a475e57

Browse files
author
Dave Bartolomeo
committed
Merge remote-tracking branch 'upstream/main' into dbartol/use-workspace-versions
2 parents 7cad4b7 + 197be69 commit a475e57

File tree

80 files changed

+1558
-586
lines changed

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

80 files changed

+1558
-586
lines changed

‎.github/workflows/atm-check-queries-run.yml

Lines changed: 47 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -1,13 +1,56 @@
11
name: ATM Check Queries Run
22

3-
# This check is required, therefore we must run it on all PRs, even if only Markdown has changed.
3+
env:
4+
DB_PATH: test_db
5+
ATM_MODEL_PACK: javascript/ql/experimental/adaptivethreatmodeling/src
6+
QUERY_SUITE: codeql-suites/javascript-atm-code-scanning.qls
7+
48
on:
9+
pull_request:
10+
paths:
11+
- ".github/workflows/atm-check-queries-run.yml"
12+
- "javascript/ql/experimental/adaptivethreatmodeling/**"
513
workflow_dispatch:
614

715
jobs:
8-
hello-world:
16+
run-atm-queries:
917
runs-on: ubuntu-latest
1018

1119
steps:
12-
- name: foo
13-
run: echo "Hello world"
20+
- uses: actions/checkout@v3
21+
22+
- name: Install CodeQL CLI
23+
env:
24+
GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
25+
run: |
26+
gh extensions install github/gh-codeql
27+
gh codeql download
28+
29+
- name: Install ATM model pack
30+
env:
31+
GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
32+
run: |
33+
set -exu
34+
35+
# Install ATM model pack
36+
gh codeql pack install ${ATM_MODEL_PACK}
37+
38+
# Retrieve model checksum
39+
model_checksum=$(gh codeql resolve extensions ${ATM_MODEL_PACK}/${QUERY_SUITE} | jq -r '.models[0].checksum')
40+
41+
# Trust the model so that we can use it in the ATM boosted queries
42+
mkdir -p "$HOME/.config/codeql"
43+
echo "--insecurely-execute-ml-model-checksums ${model_checksum}" >> "$HOME/.config/codeql/config"
44+
45+
- name: Create test DB
46+
env:
47+
GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
48+
run: |
49+
gh codeql database create ${RUNNER_TEMP}/${DB_PATH} --source-root config/atm/ --language javascript
50+
51+
- name: Run ATM query suite
52+
env:
53+
GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
54+
run: |
55+
gh codeql database run-queries -vv -- ${RUNNER_TEMP}/${DB_PATH} ${ATM_MODEL_PACK}/${QUERY_SUITE}
56+

‎.github/workflows/atm-model-integration-tests.yml

Lines changed: 12 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,12 @@
1+
name: ATM Model Integration Tests
2+
3+
on:
4+
workflow_dispatch:
5+
6+
jobs:
7+
hello-world:
8+
runs-on: ubuntu-latest
9+
10+
steps:
11+
- name: foo
12+
run: echo "Hello world"

‎config/atm/ml-powered-queries-repo/add-note.js

Lines changed: 21 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,21 @@
1+
const mongoose = require('mongoose');
2+
3+
Logger = require('./logger').Logger;
4+
Note = require('./models/note').Note;
5+
6+
(async () => {
7+
if (process.argv.length != 5) {
8+
Logger.log("Creates a private note. Usage: node add-note.js <token> <title> <body>")
9+
return;
10+
}
11+
12+
// Open the default mongoose connection
13+
await mongoose.connect('mongodb://localhost:27017/notes', { useFindAndModify: false });
14+
15+
const [userToken, title, body] = process.argv.slice(2);
16+
await Note.create({ title, body, userToken });
17+
18+
Logger.log(`Created private note with title ${title} and body ${body} belonging to user with token ${userToken}.`);
19+
20+
await mongoose.connection.close();
21+
})();

‎config/atm/ml-powered-queries-repo/app.js

Lines changed: 68 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,68 @@
1+
const bodyParser = require('body-parser');
2+
const express = require('express');
3+
const mongoose = require('mongoose');
4+
5+
const notesApi = require('./notes-api');
6+
const usersApi = require('./users-api');
7+
8+
const addSampleData = module.exports.addSampleData = async () => {
9+
const [userA, userB] = await User.create([
10+
{
11+
name: "A",
12+
token: "tokenA"
13+
},
14+
{
15+
name: "B",
16+
token: "tokenB"
17+
}
18+
]);
19+
20+
await Note.create([
21+
{
22+
title: "Public note belonging to A",
23+
body: "This is a public note belonging to A",
24+
isPublic: true,
25+
ownerToken: userA.token
26+
},
27+
{
28+
title: "Public note belonging to B",
29+
body: "This is a public note belonging to B",
30+
isPublic: true,
31+
ownerToken: userB.token
32+
},
33+
{
34+
title: "Private note belonging to A",
35+
body: "This is a private note belonging to A",
36+
ownerToken: userA.token
37+
},
38+
{
39+
title: "Private note belonging to B",
40+
body: "This is a private note belonging to B",
41+
ownerToken: userB.token
42+
}
43+
]);
44+
}
45+
46+
module.exports.startApp = async () => {
47+
// Open the default mongoose connection
48+
await mongoose.connect('mongodb://mongo:27017/notes', { useFindAndModify: false });
49+
// Drop contents of DB
50+
mongoose.connection.dropDatabase();
51+
// Add some sample data
52+
await addSampleData();
53+
54+
const app = express();
55+
56+
app.use(bodyParser.json());
57+
app.use(bodyParser.urlencoded());
58+
59+
app.get('/', async (_req, res) => {
60+
res.send('Hello World');
61+
});
62+
63+
app.use('/api/notes', notesApi.router);
64+
app.use('/api/users', usersApi.router);
65+
66+
app.listen(3000);
67+
Logger.log('Express started on port 3000');
68+
};

‎config/atm/ml-powered-queries-repo/index.js

Lines changed: 7 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,7 @@
1+
const startApp = require('./app').startApp;
2+
3+
Logger = require('./logger').Logger;
4+
Note = require('./models/note').Note;
5+
User = require('./models/user').User;
6+
7+
startApp();

‎config/atm/ml-powered-queries-repo/logger.js

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,5 @@
1+
module.exports.Logger = class {
2+
log(message, ...objs) {
3+
console.log(message, objs);
4+
}
5+
};

‎config/atm/ml-powered-queries-repo/models/note.js

Lines changed: 8 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,8 @@
1+
const mongoose = require('mongoose');
2+
3+
module.exports.Note = mongoose.model('Note', new mongoose.Schema({
4+
title: String,
5+
body: String,
6+
ownerToken: String,
7+
isPublic: Boolean
8+
}));

‎config/atm/ml-powered-queries-repo/models/user.js

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,6 @@
1+
const mongoose = require('mongoose');
2+
3+
module.exports.User = mongoose.model('User', new mongoose.Schema({
4+
name: String,
5+
token: String
6+
}));

‎config/atm/ml-powered-queries-repo/notes-api.js

Lines changed: 44 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,44 @@
1+
const express = require('express')
2+
3+
const router = module.exports.router = express.Router();
4+
5+
function serializeNote(note) {
6+
return {
7+
title: note.title,
8+
body: note.body
9+
};
10+
}
11+
12+
router.post('/find', async (req, res) => {
13+
const notes = await Note.find({
14+
ownerToken: req.body.token
15+
}).exec();
16+
res.json({
17+
notes: notes.map(serializeNote)
18+
});
19+
});
20+
21+
router.get('/findPublic', async (_req, res) => {
22+
const notes = await Note.find({
23+
isPublic: true
24+
}).exec();
25+
res.json({
26+
notes: notes.map(serializeNote)
27+
});
28+
});
29+
30+
router.post('/findVisible', async (req, res) => {
31+
const notes = await Note.find({
32+
$or: [
33+
{
34+
isPublic: true
35+
},
36+
{
37+
ownerToken: req.body.token
38+
}
39+
]
40+
}).exec();
41+
res.json({
42+
notes: notes.map(serializeNote)
43+
});
44+
});

‎config/atm/ml-powered-queries-repo/read-notes.js

Lines changed: 37 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,37 @@
1+
const mongoose = require('mongoose');
2+
3+
Logger = require('./logger').Logger;
4+
Note = require('./models/note').Note;
5+
User = require('./models/user').User;
6+
7+
(async () => {
8+
if (process.argv.length != 3) {
9+
Logger.log("Outputs all notes visible to a user. Usage: node read-notes.js <token>")
10+
return;
11+
}
12+
13+
// Open the default mongoose connection
14+
await mongoose.connect('mongodb://localhost:27017/notes', { useFindAndModify: false });
15+
16+
const ownerToken = process.argv[2];
17+
18+
const user = await User.findOne({
19+
token: ownerToken
20+
}).exec();
21+
22+
const notes = await Note.find({
23+
$or: [
24+
{ isPublic: true },
25+
{ ownerToken }
26+
]
27+
}).exec();
28+
29+
notes.map(note => {
30+
Logger.log("Title:" + note.title);
31+
Logger.log("By:" + user.name);
32+
Logger.log("Body:" + note.body);
33+
Logger.log();
34+
});
35+
36+
await mongoose.connection.close();
37+
})();

0 commit comments

Comments
 (0)