Skip to content

Commit 11edff9

Browse files
committed
Fix tests
1 parent 1a4939a commit 11edff9

File tree

1 file changed

+36
-27
lines changed

1 file changed

+36
-27
lines changed

ql/lib/codeql/actions/security/CachePoisoningQuery.qll

Lines changed: 36 additions & 27 deletions
Original file line numberDiff line numberDiff line change
@@ -11,39 +11,48 @@ string defaultBranchTriggerEvent() {
1111
]
1212
}
1313

14+
string defaultBranchNames() {
15+
exists(string default_branch_name |
16+
repositoryDataModel(_, default_branch_name) and
17+
result = default_branch_name
18+
)
19+
or
20+
not exist(string default_branch_name |
21+
repositoryDataModel(_, default_branch_name) and
22+
result = ["main", "master"]
23+
)
24+
}
25+
1426
predicate runsOnDefaultBranch(Job j) {
1527
exists(Event e |
1628
j.getATriggerEvent() = e and
17-
exists(string default_branch_name |
18-
repositoryDataModel(_, default_branch_name) and
29+
(
30+
e.getName() = defaultBranchTriggerEvent() and
31+
not e.getName() = "pull_request_target"
32+
or
33+
e.getName() = "push" and
34+
e.getAPropertyValue("branches") = defaultBranchNames()
35+
or
36+
e.getName() = "pull_request_target" and
1937
(
20-
e.getName() = defaultBranchTriggerEvent() and
21-
not e.getName() = "pull_request_target"
38+
// no filtering
39+
not e.hasProperty("branches") and not e.hasProperty("branches-ignore")
40+
or
41+
// only branches-ignore filter
42+
e.hasProperty("branches-ignore") and
43+
not e.hasProperty("branches") and
44+
not e.getAPropertyValue("branches-ignore") = defaultBranchNames()
2245
or
23-
e.getName() = "push" and
24-
e.getAPropertyValue("branches") = default_branch_name
46+
// only branches filter
47+
e.hasProperty("branches") and
48+
not e.hasProperty("branches-ignore") and
49+
e.getAPropertyValue("branches") = defaultBranchNames()
2550
or
26-
e.getName() = "pull_request_target" and
27-
(
28-
// no filtering
29-
not e.hasProperty("branches") and not e.hasProperty("branches-ignore")
30-
or
31-
// only branches-ignore filter
32-
e.hasProperty("branches-ignore") and
33-
not e.hasProperty("branches") and
34-
not e.getAPropertyValue("branches-ignore") = default_branch_name
35-
or
36-
// only branches filter
37-
e.hasProperty("branches") and
38-
not e.hasProperty("branches-ignore") and
39-
e.getAPropertyValue("branches") = default_branch_name
40-
or
41-
// branches and branches-ignore filters
42-
e.hasProperty("branches") and
43-
e.hasProperty("branches-ignore") and
44-
e.getAPropertyValue("branches") = default_branch_name and
45-
not e.getAPropertyValue("branches-ignore") = default_branch_name
46-
)
51+
// branches and branches-ignore filters
52+
e.hasProperty("branches") and
53+
e.hasProperty("branches-ignore") and
54+
e.getAPropertyValue("branches") = defaultBranchNames() and
55+
not e.getAPropertyValue("branches-ignore") = defaultBranchNames()
4756
)
4857
)
4958
)

0 commit comments

Comments
 (0)