Skip to content

Commit 4f57aad

Browse files
author
Alvaro Muñoz
committed
Improve accuracy of actions/download-artifact as a source
If upload is on the same workflow, it needs to be triggered by a priv workflow
1 parent 0cabcf8 commit 4f57aad

File tree

6 files changed

+115
-10
lines changed

6 files changed

+115
-10
lines changed

‎ql/lib/codeql/actions/security/ArtifactPoisoningQuery.qll

Lines changed: 4 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -26,8 +26,10 @@ class GitHubDownloadArtifactActionStep extends UntrustedArtifactDownloadStep, Us
2626
exists(this.getArgument("github-token"))
2727
or
2828
// There is an artifact upload step in the same workflow which can be influenced by an attacker on a checkout step
29-
exists(UsesStep checkout, UsesStep upload |
30-
this.getEnclosingWorkflow().getAJob().(LocalJob).getAStep() = checkout and
29+
exists(LocalJob job, UsesStep checkout, UsesStep upload |
30+
this.getEnclosingWorkflow().getAJob() = job and
31+
job.getAStep() = checkout and
32+
job.getATriggerEvent().getName() = "pull_request_target" and
3133
checkout.getCallee() = "actions/checkout" and
3234
checkout.getAFollowingStep() = upload and
3335
upload.getCallee() = "actions/upload-artifact"

‎ql/test/query-tests/Security/CWE-349/.github/workflows/direct_cache6.yml

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -23,7 +23,7 @@ jobs:
2323
key: ${{ runner.os }}-pip-${{ hashFiles('**/pyproject.toml') }}
2424
restore-keys: ${{ runner.os }}-pip-
2525
- name: Download artifact
26-
uses: actions/download-artifact@v4
26+
uses: dawidd6/action-download-artifact@v2
2727
with:
2828
name: results
2929
path: results/

‎ql/test/query-tests/Security/CWE-829/.github/workflows/untrusted_checkout4.yml

Lines changed: 100 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,100 @@
1+
name: Auto Bump Versions
2+
3+
on:
4+
issue_comment:
5+
types: [created, edited]
6+
7+
jobs:
8+
add-same-version-label-to-pr:
9+
runs-on: ubuntu-latest
10+
if: github.event.issue.pull_request && contains(github.event.comment.body, '/add-same-version-label')
11+
steps:
12+
- uses: actions/checkout@v3
13+
- name: Add same version label
14+
uses: actions/github-script@v6
15+
if: success()
16+
with:
17+
github-token: ${{secrets.GITHUB_TOKEN}}
18+
script: |
19+
github.rest.issues.addLabels({
20+
issue_number: context.issue.number,
21+
owner: context.repo.owner,
22+
repo: context.repo.repo,
23+
labels: ['same version']
24+
})
25+
github.rest.issues.createComment({
26+
issue_number: context.issue.number,
27+
owner: context.repo.owner,
28+
repo: context.repo.repo,
29+
body: '👋 Added [same version] label :)!'
30+
})
31+
32+
build:
33+
if: ${{ github.event.issue.pull_request }} && contains(github.event.comment.body, '/version')
34+
runs-on: ubuntu-latest
35+
36+
steps:
37+
- name: Get PR details
38+
uses: actions/github-script@v6
39+
id: get-pr
40+
with:
41+
script: |
42+
const request = {
43+
owner: context.repo.owner,
44+
repo: context.repo.repo,
45+
pull_number: context.issue.number
46+
}
47+
core.info(`Getting PR #${request.pull_number} from ${request.owner}/${request.repo}`)
48+
try {
49+
const result = await github.rest.pulls.get(request)
50+
return result.data
51+
} catch (err) {
52+
core.setFailed(`Request failed with error ${err}`)
53+
}
54+
55+
- name: Checkout PR
56+
uses: actions/checkout@v3
57+
with:
58+
repository: ${{ fromJSON(steps.get-pr.outputs.result).head.repo.full_name }}
59+
ref: ${{ fromJSON(steps.get-pr.outputs.result).head.ref }}
60+
61+
- name: Update version minor
62+
if: contains(github.event.comment.body, '/version minor')
63+
run: |
64+
./version.sh -u -n
65+
echo "BUMP_TYPE=minor" >> $GITHUB_ENV
66+
67+
- name: Update version major
68+
if: contains(github.event.comment.body, '/version major')
69+
run: |
70+
./version.sh -u -m
71+
echo "BUMP_TYPE=major" >> $GITHUB_ENV
72+
73+
- name: Update version patch
74+
if: contains(github.event.comment.body, '/version patch')
75+
run: |
76+
./version.sh -u -p
77+
echo "BUMP_TYPE=patch" >> $GITHUB_ENV
78+
79+
- name: Add labels
80+
uses: actions/github-script@v6
81+
if: ${{ env.BUMP_TYPE }}
82+
with:
83+
script: |
84+
github.rest.issues.addLabels({
85+
issue_number: context.issue.number,
86+
owner: context.repo.owner,
87+
repo: context.repo.repo,
88+
labels: ['version/${{ env.BUMP_TYPE }}']
89+
})
90+
91+
- name: Push Changes
92+
if: ${{ env.BUMP_TYPE }}
93+
run: |
94+
git config user.name 'github-actions[bot]'
95+
git config user.email 'github-actions[bot]@users.noreply.github.com'
96+
git pull
97+
git add .
98+
git commit -m "Update ${{ env.BUMP_TYPE }} version" --signoff
99+
git push
100+

‎ql/test/query-tests/Security/CWE-829/ArtifactPoisoningCritical.expected

Lines changed: 0 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -14,7 +14,6 @@ edges
1414
| .github/workflows/artifactpoisoning53.yml:13:9:15:6 | Run Step | .github/workflows/artifactpoisoning53.yml:18:14:23:29 | {\n echo 'JSON_RESPONSE<<EOF'\n ls \| grep -E "*.(tar.gz\|zip)$"\n echo EOF\n} >> "$GITHUB_ENV"\n | provenance | |
1515
| .github/workflows/artifactpoisoning71.yml:9:9:16:6 | Uses Step | .github/workflows/artifactpoisoning71.yml:17:14:18:40 | sed -f config foo.md > bar.md\n | provenance | |
1616
| .github/workflows/artifactpoisoning81.yml:28:9:31:6 | Uses Step | .github/workflows/artifactpoisoning81.yml:31:14:31:27 | python test.py | provenance | |
17-
| .github/workflows/artifactpoisoning82.yml:28:9:31:6 | Uses Step | .github/workflows/artifactpoisoning82.yml:31:14:31:27 | python test.py | provenance | |
1817
nodes
1918
| .github/workflows/artifactpoisoning11.yml:13:9:32:6 | Uses Step | semmle.label | Uses Step |
2019
| .github/workflows/artifactpoisoning11.yml:38:11:38:77 | ./sonarcloud-data/x.py build -j$(nproc) --compiler gcc --skip-build | semmle.label | ./sonarcloud-data/x.py build -j$(nproc) --compiler gcc --skip-build |
@@ -46,8 +45,6 @@ nodes
4645
| .github/workflows/artifactpoisoning71.yml:17:14:18:40 | sed -f config foo.md > bar.md\n | semmle.label | sed -f config foo.md > bar.md\n |
4746
| .github/workflows/artifactpoisoning81.yml:28:9:31:6 | Uses Step | semmle.label | Uses Step |
4847
| .github/workflows/artifactpoisoning81.yml:31:14:31:27 | python test.py | semmle.label | python test.py |
49-
| .github/workflows/artifactpoisoning82.yml:28:9:31:6 | Uses Step | semmle.label | Uses Step |
50-
| .github/workflows/artifactpoisoning82.yml:31:14:31:27 | python test.py | semmle.label | python test.py |
5148
subpaths
5249
#select
5350
| .github/workflows/artifactpoisoning11.yml:38:11:38:77 | ./sonarcloud-data/x.py build -j$(nproc) --compiler gcc --skip-build | .github/workflows/artifactpoisoning11.yml:13:9:32:6 | Uses Step | .github/workflows/artifactpoisoning11.yml:38:11:38:77 | ./sonarcloud-data/x.py build -j$(nproc) --compiler gcc --skip-build | Potential artifact poisoning in $@, which may be controlled by an external user. | .github/workflows/artifactpoisoning11.yml:38:11:38:77 | ./sonarcloud-data/x.py build -j$(nproc) --compiler gcc --skip-build | ./sonarcloud-data/x.py build -j$(nproc) --compiler gcc --skip-build |

‎ql/test/query-tests/Security/CWE-829/ArtifactPoisoningMedium.expected

Lines changed: 0 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -14,7 +14,6 @@ edges
1414
| .github/workflows/artifactpoisoning53.yml:13:9:15:6 | Run Step | .github/workflows/artifactpoisoning53.yml:18:14:23:29 | {\n echo 'JSON_RESPONSE<<EOF'\n ls \| grep -E "*.(tar.gz\|zip)$"\n echo EOF\n} >> "$GITHUB_ENV"\n | provenance | |
1515
| .github/workflows/artifactpoisoning71.yml:9:9:16:6 | Uses Step | .github/workflows/artifactpoisoning71.yml:17:14:18:40 | sed -f config foo.md > bar.md\n | provenance | |
1616
| .github/workflows/artifactpoisoning81.yml:28:9:31:6 | Uses Step | .github/workflows/artifactpoisoning81.yml:31:14:31:27 | python test.py | provenance | |
17-
| .github/workflows/artifactpoisoning82.yml:28:9:31:6 | Uses Step | .github/workflows/artifactpoisoning82.yml:31:14:31:27 | python test.py | provenance | |
1817
nodes
1918
| .github/workflows/artifactpoisoning11.yml:13:9:32:6 | Uses Step | semmle.label | Uses Step |
2019
| .github/workflows/artifactpoisoning11.yml:38:11:38:77 | ./sonarcloud-data/x.py build -j$(nproc) --compiler gcc --skip-build | semmle.label | ./sonarcloud-data/x.py build -j$(nproc) --compiler gcc --skip-build |
@@ -46,8 +45,5 @@ nodes
4645
| .github/workflows/artifactpoisoning71.yml:17:14:18:40 | sed -f config foo.md > bar.md\n | semmle.label | sed -f config foo.md > bar.md\n |
4746
| .github/workflows/artifactpoisoning81.yml:28:9:31:6 | Uses Step | semmle.label | Uses Step |
4847
| .github/workflows/artifactpoisoning81.yml:31:14:31:27 | python test.py | semmle.label | python test.py |
49-
| .github/workflows/artifactpoisoning82.yml:28:9:31:6 | Uses Step | semmle.label | Uses Step |
50-
| .github/workflows/artifactpoisoning82.yml:31:14:31:27 | python test.py | semmle.label | python test.py |
5148
subpaths
5249
#select
53-
| .github/workflows/artifactpoisoning82.yml:31:14:31:27 | python test.py | .github/workflows/artifactpoisoning82.yml:28:9:31:6 | Uses Step | .github/workflows/artifactpoisoning82.yml:31:14:31:27 | python test.py | Potential artifact poisoning in $@, which may be controlled by an external user. | .github/workflows/artifactpoisoning82.yml:31:14:31:27 | python test.py | python test.py |

‎ql/test/query-tests/Security/CWE-829/UntrustedCheckoutCritical.expected

Lines changed: 10 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -147,6 +147,13 @@ edges
147147
| .github/workflows/untrusted_checkout3.yml:11:9:12:6 | Uses Step | .github/workflows/untrusted_checkout3.yml:12:9:13:6 | Uses Step |
148148
| .github/workflows/untrusted_checkout3.yml:12:9:13:6 | Uses Step | .github/actions/dangerous-git-checkout/action.yml:6:7:11:4 | Uses Step |
149149
| .github/workflows/untrusted_checkout3.yml:12:9:13:6 | Uses Step | .github/workflows/untrusted_checkout3.yml:13:9:13:23 | Run Step |
150+
| .github/workflows/untrusted_checkout4.yml:12:7:13:4 | Uses Step | .github/workflows/untrusted_checkout4.yml:13:7:32:2 | Uses Step |
151+
| .github/workflows/untrusted_checkout4.yml:37:7:55:4 | Uses Step: get-pr | .github/workflows/untrusted_checkout4.yml:55:7:61:4 | Uses Step |
152+
| .github/workflows/untrusted_checkout4.yml:55:7:61:4 | Uses Step | .github/workflows/untrusted_checkout4.yml:61:7:67:4 | Run Step |
153+
| .github/workflows/untrusted_checkout4.yml:61:7:67:4 | Run Step | .github/workflows/untrusted_checkout4.yml:67:7:73:4 | Run Step |
154+
| .github/workflows/untrusted_checkout4.yml:67:7:73:4 | Run Step | .github/workflows/untrusted_checkout4.yml:73:7:79:4 | Run Step |
155+
| .github/workflows/untrusted_checkout4.yml:73:7:79:4 | Run Step | .github/workflows/untrusted_checkout4.yml:79:7:91:4 | Uses Step |
156+
| .github/workflows/untrusted_checkout4.yml:79:7:91:4 | Uses Step | .github/workflows/untrusted_checkout4.yml:91:7:100:9 | Run Step |
150157
| .github/workflows/untrusted_checkout.yml:10:9:13:6 | Uses Step | .github/workflows/untrusted_checkout.yml:13:9:16:6 | Uses Step |
151158
| .github/workflows/untrusted_checkout.yml:13:9:16:6 | Uses Step | .github/workflows/untrusted_checkout.yml:16:9:20:6 | Uses Step |
152159
| .github/workflows/untrusted_checkout.yml:16:9:20:6 | Uses Step | .github/workflows/untrusted_checkout.yml:20:9:22:23 | Run Step |
@@ -171,5 +178,8 @@ edges
171178
| .github/workflows/test7.yml:49:9:58:20 | Run Step: benchmark-pr | .github/workflows/test7.yml:19:9:24:6 | Uses Step | .github/workflows/test7.yml:49:9:58:20 | Run Step: benchmark-pr | Execution of untrusted code on a privileged workflow. |
172179
| .github/workflows/test9.yml:16:9:17:48 | Run Step | .github/workflows/test9.yml:11:9:16:6 | Uses Step | .github/workflows/test9.yml:16:9:17:48 | Run Step | Execution of untrusted code on a privileged workflow. |
173180
| .github/workflows/untrusted_checkout3.yml:13:9:13:23 | Run Step | .github/actions/dangerous-git-checkout/action.yml:6:7:11:4 | Uses Step | .github/workflows/untrusted_checkout3.yml:13:9:13:23 | Run Step | Execution of untrusted code on a privileged workflow. |
181+
| .github/workflows/untrusted_checkout4.yml:61:7:67:4 | Run Step | .github/workflows/untrusted_checkout4.yml:55:7:61:4 | Uses Step | .github/workflows/untrusted_checkout4.yml:61:7:67:4 | Run Step | Execution of untrusted code on a privileged workflow. |
182+
| .github/workflows/untrusted_checkout4.yml:67:7:73:4 | Run Step | .github/workflows/untrusted_checkout4.yml:55:7:61:4 | Uses Step | .github/workflows/untrusted_checkout4.yml:67:7:73:4 | Run Step | Execution of untrusted code on a privileged workflow. |
183+
| .github/workflows/untrusted_checkout4.yml:73:7:79:4 | Run Step | .github/workflows/untrusted_checkout4.yml:55:7:61:4 | Uses Step | .github/workflows/untrusted_checkout4.yml:73:7:79:4 | Run Step | Execution of untrusted code on a privileged workflow. |
174184
| .github/workflows/untrusted_checkout.yml:20:9:22:23 | Run Step | .github/workflows/untrusted_checkout.yml:10:9:13:6 | Uses Step | .github/workflows/untrusted_checkout.yml:20:9:22:23 | Run Step | Execution of untrusted code on a privileged workflow. |
175185
| .github/workflows/untrusted_checkout.yml:20:9:22:23 | Run Step | .github/workflows/untrusted_checkout.yml:13:9:16:6 | Uses Step | .github/workflows/untrusted_checkout.yml:20:9:22:23 | Run Step | Execution of untrusted code on a privileged workflow. |

0 commit comments

Comments
 (0)