Skip to content

Commit 188f9d5

Browse files
author
Alvaro Muñoz
authored
Merge pull request #34 from GitHubSecurityLab/refactor_queries
Refactor queries
2 parents 92dbceb + 169e57e commit 188f9d5

26 files changed

+501
-628
lines changed

‎ql/lib/codeql/actions/security/CodeInjectionQuery.qll

Lines changed: 25 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,25 @@
1+
private import actions
2+
private import codeql.actions.TaintTracking
3+
private import codeql.actions.dataflow.ExternalFlow
4+
import codeql.actions.dataflow.FlowSources
5+
import codeql.actions.DataFlow
6+
7+
class CodeInjectionSink extends DataFlow::Node {
8+
CodeInjectionSink() {
9+
exists(Run e | e.getAnScriptExpr() = this.asExpr()) or
10+
externallyDefinedSink(this, "code-injection")
11+
}
12+
}
13+
14+
/**
15+
* A taint-tracking configuration for unsafe user input
16+
* that is used to construct and evaluate a code script.
17+
*/
18+
private module CodeInjectionConfig implements DataFlow::ConfigSig {
19+
predicate isSource(DataFlow::Node source) { source instanceof RemoteFlowSource }
20+
21+
predicate isSink(DataFlow::Node sink) { sink instanceof CodeInjectionSink }
22+
}
23+
24+
/** Tracks flow of unsafe user input that is used to construct and evaluate a code script. */
25+
module CodeInjectionFlow = TaintTracking::Global<CodeInjectionConfig>;

‎ql/lib/codeql/actions/security/CommandInjectionQuery.qll

Lines changed: 22 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,22 @@
1+
private import actions
2+
private import codeql.actions.TaintTracking
3+
private import codeql.actions.dataflow.ExternalFlow
4+
import codeql.actions.dataflow.FlowSources
5+
import codeql.actions.DataFlow
6+
7+
private class CommandInjectionSink extends DataFlow::Node {
8+
CommandInjectionSink() { externallyDefinedSink(this, "command-injection") }
9+
}
10+
11+
/**
12+
* A taint-tracking configuration for unsafe user input
13+
* that is used to construct and evaluate a system command.
14+
*/
15+
private module CommandInjectionConfig implements DataFlow::ConfigSig {
16+
predicate isSource(DataFlow::Node source) { source instanceof RemoteFlowSource }
17+
18+
predicate isSink(DataFlow::Node sink) { sink instanceof CommandInjectionSink }
19+
}
20+
21+
/** Tracks flow of unsafe user input that is used to construct and evaluate a system command. */
22+
module CommandInjectionFlow = TaintTracking::Global<CommandInjectionConfig>;

‎ql/lib/codeql/actions/security/RequestForgeryQuery.qll

Lines changed: 22 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,22 @@
1+
private import actions
2+
private import codeql.actions.TaintTracking
3+
private import codeql.actions.dataflow.ExternalFlow
4+
import codeql.actions.dataflow.FlowSources
5+
import codeql.actions.DataFlow
6+
7+
private class RequestForgerySink extends DataFlow::Node {
8+
RequestForgerySink() { externallyDefinedSink(this, "request-forgery") }
9+
}
10+
11+
/**
12+
* A taint-tracking configuration for unsafe user input
13+
* that is used to construct and evaluate a system command.
14+
*/
15+
private module RequestForgeryConfig implements DataFlow::ConfigSig {
16+
predicate isSource(DataFlow::Node source) { source instanceof RemoteFlowSource }
17+
18+
predicate isSink(DataFlow::Node sink) { sink instanceof RequestForgerySink }
19+
}
20+
21+
/** Tracks flow of unsafe user input that is used to construct and evaluate a system command. */
22+
module RequestForgeryFlow = TaintTracking::Global<RequestForgeryConfig>;

‎ql/lib/ext/TEST-RW-MODELS.model.yml

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -14,4 +14,4 @@ extensions:
1414
pack: githubsecuritylab/actions-all
1515
extensible: sinkModel
1616
data:
17-
- ["octo-org/sink-repo/.github/workflows/workflow.yml", "*", "input.config-path", "expression-injection"]
17+
- ["octo-org/sink-repo/.github/workflows/workflow.yml", "*", "input.config-path", "code-injection"]

‎ql/src/Security/CWE-020/CompositeActionsSinks.ql

Lines changed: 2 additions & 10 deletions
Original file line numberDiff line numberDiff line change
@@ -12,24 +12,16 @@
1212
*/
1313

1414
import actions
15-
import codeql.actions.DataFlow
15+
import codeql.actions.security.CodeInjectionQuery
1616
import codeql.actions.TaintTracking
17-
import codeql.actions.dataflow.FlowSources
1817
import codeql.actions.dataflow.ExternalFlow
1918

20-
private class ExpressionInjectionSink extends DataFlow::Node {
21-
ExpressionInjectionSink() {
22-
exists(Run e | e.getAnScriptExpr() = this.asExpr()) or
23-
externallyDefinedSink(this, "expression-injection")
24-
}
25-
}
26-
2719
private module MyConfig implements DataFlow::ConfigSig {
2820
predicate isSource(DataFlow::Node source) {
2921
exists(CompositeAction c | c.getAnInput() = source.asExpr())
3022
}
3123

32-
predicate isSink(DataFlow::Node sink) { sink instanceof ExpressionInjectionSink }
24+
predicate isSink(DataFlow::Node sink) { sink instanceof CodeInjectionSink }
3325
}
3426

3527
module MyFlow = TaintTracking::Global<MyConfig>;

‎ql/src/Security/CWE-020/ReusableWorkflowsSinks.ql

Lines changed: 2 additions & 10 deletions
Original file line numberDiff line numberDiff line change
@@ -12,24 +12,16 @@
1212
*/
1313

1414
import actions
15-
import codeql.actions.DataFlow
15+
import codeql.actions.security.CodeInjectionQuery
1616
import codeql.actions.TaintTracking
17-
import codeql.actions.dataflow.FlowSources
1817
import codeql.actions.dataflow.ExternalFlow
1918

20-
private class ExpressionInjectionSink extends DataFlow::Node {
21-
ExpressionInjectionSink() {
22-
exists(Run e | e.getAnScriptExpr() = this.asExpr()) or
23-
externallyDefinedSink(this, "expression-injection")
24-
}
25-
}
26-
2719
private module MyConfig implements DataFlow::ConfigSig {
2820
predicate isSource(DataFlow::Node source) {
2921
exists(ReusableWorkflow w | w.getAnInput() = source.asExpr())
3022
}
3123

32-
predicate isSink(DataFlow::Node sink) { sink instanceof ExpressionInjectionSink }
24+
predicate isSink(DataFlow::Node sink) { sink instanceof CodeInjectionSink }
3325
}
3426

3527
module MyFlow = TaintTracking::Global<MyConfig>;

‎ql/src/Security/CWE-078/CommandInjection.ql

Lines changed: 4 additions & 20 deletions
Original file line numberDiff line numberDiff line change
@@ -13,27 +13,11 @@
1313
*/
1414

1515
import actions
16-
import codeql.actions.DataFlow
17-
import codeql.actions.TaintTracking
18-
import codeql.actions.dataflow.FlowSources
19-
import codeql.actions.dataflow.ExternalFlow
16+
import codeql.actions.security.CommandInjectionQuery
17+
import CommandInjectionFlow::PathGraph
2018

21-
private class CommandInjectionSink extends DataFlow::Node {
22-
CommandInjectionSink() { externallyDefinedSink(this, "command-injection") }
23-
}
24-
25-
private module MyConfig implements DataFlow::ConfigSig {
26-
predicate isSource(DataFlow::Node source) { source instanceof RemoteFlowSource }
27-
28-
predicate isSink(DataFlow::Node sink) { sink instanceof CommandInjectionSink }
29-
}
30-
31-
module MyFlow = TaintTracking::Global<MyConfig>;
32-
33-
import MyFlow::PathGraph
34-
35-
from MyFlow::PathNode source, MyFlow::PathNode sink
36-
where MyFlow::flowPath(source, sink)
19+
from CommandInjectionFlow::PathNode source, CommandInjectionFlow::PathNode sink
20+
where CommandInjectionFlow::flowPath(source, sink)
3721
select sink.getNode(), source, sink,
3822
"Potential command injection in $@, which may be controlled by an external user.", sink,
3923
sink.getNode().asExpr().(Expression).getRawExpression()

‎ql/src/Security/CWE-078/CriticalCommandInjection.ql

Lines changed: 0 additions & 45 deletions
This file was deleted.

‎ql/src/Security/CWE-078/PrivilegedCommandInjection.ql

Lines changed: 29 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,29 @@
1+
/**
2+
* @name Command built from user-controlled sources on a privileged context
3+
* @description Building a system command from user-controlled sources is vulnerable to insertion of
4+
* malicious code by the user.
5+
* @kind path-problem
6+
* @problem.severity error
7+
* @security-severity 9
8+
* @precision high
9+
* @id actions/privileged-command-injection
10+
* @tags actions
11+
* security
12+
* external/cwe/cwe-078
13+
*/
14+
15+
import actions
16+
import codeql.actions.security.CommandInjectionQuery
17+
import CommandInjectionFlow::PathGraph
18+
19+
from CommandInjectionFlow::PathNode source, CommandInjectionFlow::PathNode sink, Workflow w
20+
where
21+
CommandInjectionFlow::flowPath(source, sink) and
22+
w = source.getNode().asExpr().getEnclosingWorkflow() and
23+
(
24+
w instanceof ReusableWorkflow or
25+
w.hasTriggerEvent(source.getNode().(RemoteFlowSource).getATriggerEvent())
26+
)
27+
select sink.getNode(), source, sink,
28+
"Potential privileged command injection in $@, which may be controlled by an external user.",
29+
sink, sink.getNode().asExpr().(Expression).getRawExpression()

‎ql/src/Security/CWE-094/CodeInjection.ql

Lines changed: 4 additions & 20 deletions
Original file line numberDiff line numberDiff line change
@@ -15,27 +15,11 @@
1515
*/
1616

1717
import actions
18-
import codeql.actions.DataFlow
19-
import codeql.actions.TaintTracking
20-
import codeql.actions.dataflow.FlowSources
21-
import codeql.actions.dataflow.ExternalFlow
18+
import codeql.actions.security.CodeInjectionQuery
19+
import CodeInjectionFlow::PathGraph
2220

23-
private class CodeInjectionSink extends DataFlow::Node {
24-
CodeInjectionSink() { externallyDefinedSink(this, "code-injection") }
25-
}
26-
27-
private module MyConfig implements DataFlow::ConfigSig {
28-
predicate isSource(DataFlow::Node source) { source instanceof RemoteFlowSource }
29-
30-
predicate isSink(DataFlow::Node sink) { sink instanceof CodeInjectionSink }
31-
}
32-
33-
module MyFlow = TaintTracking::Global<MyConfig>;
34-
35-
import MyFlow::PathGraph
36-
37-
from MyFlow::PathNode source, MyFlow::PathNode sink
38-
where MyFlow::flowPath(source, sink)
21+
from CodeInjectionFlow::PathNode source, CodeInjectionFlow::PathNode sink
22+
where CodeInjectionFlow::flowPath(source, sink)
3923
select sink.getNode(), source, sink,
4024
"Potential code injection in $@, which may be controlled by an external user.", sink,
4125
sink.getNode().asExpr().(Expression).getRawExpression()

0 commit comments

Comments
 (0)