Merge branch 'master' of https://github.com/github/codeql-actions

Author: Alvaro Muñoz

.github/workflows/copy-to-bughalla.yml

@@ -1,6 +1,9 @@
 name: Copy to Bughalla
 
-on: push
+on:
+  push:
+    branches:
+      - 'master'
 
 permissions:
   contents: read

ql/lib/codeql/actions/ast/internal/Ast.qll

@@ -791,6 +791,8 @@ abstract class UsesImpl extends AstNodeImpl {
 
   abstract string getVersion();
 
+  int getMajorVersion() { result = this.getVersion().regexpReplaceAll("\\..*", "").toInt() }
+
   /** Gets the argument expression for the given key. */
   string getArgument(string key) {
     exists(ScalarValueImpl scalar |
@@ -832,8 +834,10 @@ class UsesStepImpl extends StepImpl, UsesImpl {
       ).toLowerCase()
   }
 
-  /** Gets the version reference used when checking out the Action, e.g. `v2` in `actions/checkout@v2`. */
-  override string getVersion() { result = u.getValue().regexpCapture(usesParser(), 3) }
+  /** Gets the version reference used when checking out the Action, e.g. `2` in `actions/checkout@v2`. */
+  override string getVersion() {
+    result = u.getValue().regexpCapture(usesParser(), 3).regexpReplaceAll("^v", "")
+  }
 
   override string toString() {
     if exists(this.getId()) then result = "Uses Step: " + this.getId() else result = "Uses Step"
@@ -865,12 +869,12 @@ class ExternalJobImpl extends JobImpl, UsesImpl {
           u.getValue().regexpCapture(repoUsesParser(), 3)
   }
 
-  /** Gets the version reference used when checking out the Action, e.g. `v2` in `actions/checkout@v2`. */
+  /** Gets the version reference used when checking out the Action, e.g. `2` in `actions/checkout@v2`. */
   override string getVersion() {
     exists(YamlString name |
       n.lookup("uses") = name and
       if not name.getValue().matches("\\.%")
-      then result = name.getValue().regexpCapture(repoUsesParser(), 4)
+      then result = name.getValue().regexpCapture(repoUsesParser(), 4).regexpReplaceAll("^v", "")
       else none()
     )
   }

ql/lib/codeql/actions/dataflow/FlowSources.qll

@@ -263,7 +263,7 @@ private class ArtifactSource extends RemoteFlowSource {
 /**
  * A list of file names returned by dorny/paths-filter.
  */
-private class DornyPathsFilterSource extends RemoteFlowSource {
+class DornyPathsFilterSource extends RemoteFlowSource {
   DornyPathsFilterSource() {
     exists(UsesStep u |
       u.getCallee() = "dorny/paths-filter" and
@@ -274,3 +274,86 @@ private class DornyPathsFilterSource extends RemoteFlowSource {
 
   override string getSourceType() { result = "filename" }
 }
+
+/**
+ * A list of file names returned by tj-actions/changed-files.
+ */
+class TJActionsChangedFilesSource extends RemoteFlowSource {
+  TJActionsChangedFilesSource() {
+    exists(UsesStep u |
+      u.getCallee() = "tj-actions/changed-files" and
+      (
+        u.getArgument("safe_output") = "false" or
+        u.getMajorVersion() < 41 or
+        u.getVersion()
+            .matches([
+                  "56284d8", "9454999", "1c93849", "da093c1", "25ef392", "18c8a4e", "4052680",
+                  "bfc49f4", "af292f1", "56284d8", "fea790c", "95690f9", "408093d", "db153ba",
+                  "8238a41", "4196030", "a21a533", "8e79ba7", "76c4d81", "6ee9cdc", "246636f",
+                  "48566bb", "fea790c", "1aee362", "2f7246c", "0fc9663", "c860b5c", "2f8b802",
+                  "b7f1b73", "1c26215", "17f3fec", "1aee362", "a0585ff", "87697c0", "85c8b82",
+                  "a96679d", "920e7b9", "de0eba3", "3928317", "68b429d", "2a968ff", "1f20fb8",
+                  "87e23c4", "54849de", "bb33761", "ec1e14c", "2106eb4", "e5efec4", "5817a9e",
+                  "a0585ff", "54479c3", "e1754a4", "9bf0914", "c912451", "174a2a6", "fb20f4d",
+                  "07e0177", "b137868", "1aae160", "5d2fcdb", "9ecc6e7", "8c9ee56", "5978e5a",
+                  "17c3e9e", "3f7b5c9", "cf4fe87", "043929e", "4e2535f", "652648a", "9ad1a5b",
+                  "c798a4e", "25eaddf", "abef388", "1c2673b", "53c377a", "54479c3", "039afcd",
+                  "b2d17f5", "4a0aac0", "ce810b2", "7ecfc67", "b109d83", "79adacd", "6e426e6",
+                  "5e2d64b", "e9b5807", "db5dd7c", "07f86bc", "3a3ec49", "ee13744", "cda2902",
+                  "9328bab", "4e680e1", "bd376fb", "84ed30e", "74b06ca", "5ce975c", "04124ef",
+                  "3ee6abf", "23e3c43", "5a331a4", "7433886", "d5414fd", "7f2aa19", "210cc83",
+                  "db3ea27", "57d9664", "0953088", "0562b9f", "487675b", "9a6dabf", "7839ede",
+                  "c2296c1", "ea251d4", "1d1287f", "392359f", "7f33882", "1d8a2f9", "0626c3f",
+                  "a2b1e5d", "110b9ba", "039afcd", "ce4b8e3", "3b6c057", "4f64429", "3f1e44a",
+                  "74dc2e8", "8356a01", "baaf598", "8a4cc4f", "8a7336f", "3996bc3", "ef0a290",
+                  "3ebdc42", "94e6fba", "3dbb79f", "991e8b3", "72d3bb8", "72d3bb8", "5f89dc7",
+                  "734bb16", "d2e030b", "6ba3c59", "d0e4477", "b91acef", "1263363", "7184077",
+                  "cbfb0fd", "932dad3", "9f28968", "c4d29bf", "ce4b8e3", "aa52cfc", "aa52cfc",
+                  "1d6e210", "8953e85", "8de562e", "7c640bd", "2706452", "1d6e210", "dd7c814",
+                  "528984a", "75af1a4", "5184a75", "dd7c814", "402f382", "402f382", "f7a5640",
+                  "df4daca", "602081b", "6e12407", "c5c9b6f", "c41b715", "60f4aab", "82edb42",
+                  "18edda7", "bec82eb", "f7a5640", "28ac672", "602cf94", "5e56dca", "58ae566",
+                  "7394701", "36e65a1", "bf6ddb7", "6c44eb8", "b2ee165", "34a865a", "fb1fe28",
+                  "ae90a0b", "bc1dc8f", "3de1f9a", "0edfedf", "2054502", "944a8b8", "581eef0",
+                  "e55f7fb", "07b38ce", "d262520", "a6d456f", "a59f800", "a2f1692", "72aab29",
+                  "e35d0af", "081ee9c", "1f30bd2", "227e314", "ffd30e8", "f5a8de7", "0bc7d40",
+                  "a53d74f", "9335416", "4daffba", "4b1f26a", "09441d3", "e44053b", "c0dba81",
+                  "fd2e991", "2a8a501", "a8ea720", "88edda5", "be68c10", "b59431b", "68bd279",
+                  "2c85495", "f276697", "00f80ef", "f56e736", "019a09d", "3b638a9", "b42f932",
+                  "8dfe0ee", "aae164d", "09a8797", "b54a7ae", "902e607", "2b51570", "040111b",
+                  "3b638a9", "1d34e69", "b86b537", "2a771ad", "75933dc", "2c0d12b", "7abdbc9",
+                  "675ab58", "8c6f276", "d825b1f", "0bd70b7", "0fe67a1", "7bfa539", "d679de9",
+                  "1e10ed4", "0754fda", "d290bdd", "15b1769", "2ecd06d", "5fe8e4d", "7c66aa2",
+                  "2ecd06d", "e95bba8", "7852058", "81f32e2", "450eadf", "0e956bb", "300e935",
+                  "fcb2ab8", "271bbd6", "e8ace01", "473984b", "032f37f", "3a35bdf", "c2216f6",
+                  "0f16c26", "271468e", "fb063fc", "a05436f", "c061ef1", "489e2d5", "8d5a33c",
+                  "fbfaba5", "1980f55", "a86b560", "f917cc3", "e18ccae", "e1d275d", "00f80ef",
+                  "9c1a181", "5eaa2d8", "188487d", "3098891", "467d26c", "d9eb683", "09a8797",
+                  "8e7cc77", "81ad4b8", "5e2a2f1", "1af9ab3", "55a857d", "62a9200", "b915d09",
+                  "f0751de", "eef9423"
+                ] + "%")
+      ) and
+      this.asExpr() = u
+    )
+  }
+
+  override string getSourceType() { result = "filename" }
+}
+
+/**
+ * A list of file names returned by tj-actions/verify-changed-files.
+ */
+class TJActionsVerifyChangedFilesSource extends RemoteFlowSource {
+  TJActionsVerifyChangedFilesSource() {
+    exists(UsesStep u |
+      u.getCallee() = "tj-actions/verify-changed-files" and
+      (
+        u.getArgument("safe_output") = "false" or
+        u.getMajorVersion() < 17
+      ) and
+      this.asExpr() = u
+    )
+  }
+
+  override string getSourceType() { result = "filename" }
+}

ql/lib/codeql/actions/dataflow/FlowSteps.qll

@@ -5,6 +5,7 @@
 private import actions
 private import codeql.util.Unit
 private import codeql.actions.DataFlow
+private import codeql.actions.dataflow.FlowSources
 private import codeql.actions.dataflow.ExternalFlow
 private import codeql.actions.security.ArtifactPoisoningQuery
 
@@ -43,10 +44,6 @@ predicate envToRunStep(DataFlow::Node pred, DataFlow::Node succ) {
   )
 }
 
-class EnvToRunTaintStep extends AdditionalTaintStep {
-  override predicate step(DataFlow::Node node1, DataFlow::Node node2) { envToRunStep(node1, node2) }
-}
-
 /**
  * Holds if a Run step declares an environment variable, uses it in its script and sets an output in its script.
  * e.g.
@@ -119,28 +116,57 @@ predicate artifactDownloadToUseStep(DataFlow::Node pred, DataFlow::Node succ) {
   )
 }
 
-class ArtifactDownloadToUseTaintStep extends AdditionalTaintStep {
-  override predicate step(DataFlow::Node node1, DataFlow::Node node2) {
-    artifactDownloadToUseStep(node1, node2)
-  }
-}
-
 /**
  * A read of the _files field of the dorny/paths-filter action.
  */
 predicate dornyPathsFilterTaintStep(DataFlow::Node pred, DataFlow::Node succ) {
-  exists(UsesStep u, StepsExpression o |
-    u.getCallee() = "dorny/paths-filter" and
-    u.getArgument("list-files") = ["csv", "json"] and
-    u = pred.asExpr() and
-    o.getStepId() = u.getId() and
+  exists(StepsExpression o |
+    pred instanceof DornyPathsFilterSource and
+    o.getStepId() = pred.asExpr().(UsesStep).getId() and
     o.getFieldName().matches("%_files") and
     succ.asExpr() = o
   )
 }
 
-class DornyPathsFilterTaintStep extends AdditionalTaintStep {
+/**
+ * A read of user-controlled field of the tj-actions/changed-files action.
+ */
+predicate tjActionsChangedFilesTaintStep(DataFlow::Node pred, DataFlow::Node succ) {
+  exists(StepsExpression o |
+    pred instanceof TJActionsChangedFilesSource and
+    o.getTarget() = pred.asExpr() and
+    o.getStepId() = pred.asExpr().(UsesStep).getId() and
+    o.getFieldName() =
+      [
+        "added_files", "copied_files", "deleted_files", "modified_files", "renamed_files",
+        "all_old_new_renamed_files", "type_changed_files", "unmerged_files", "unknown_files",
+        "all_changed_and_modified_files", "all_changed_files", "other_changed_files",
+        "all_modified_files", "other_modified_files", "other_deleted_files", "modified_keys",
+        "changed_keys"
+      ] and
+    succ.asExpr() = o
+  )
+}
+
+/**
+ * A read of user-controlled field of the tj-actions/verify-changed-files action.
+ */
+predicate tjActionsVerifyChangedFilesTaintStep(DataFlow::Node pred, DataFlow::Node succ) {
+  exists(StepsExpression o |
+    pred instanceof TJActionsChangedFilesSource and
+    o.getTarget() = pred.asExpr() and
+    o.getStepId() = pred.asExpr().(UsesStep).getId() and
+    o.getFieldName() = "changed_files" and
+    succ.asExpr() = o
+  )
+}
+
+class TaintSteps extends AdditionalTaintStep {
   override predicate step(DataFlow::Node node1, DataFlow::Node node2) {
-    dornyPathsFilterTaintStep(node1, node2)
+    envToRunStep(node1, node2) or
+    artifactDownloadToUseStep(node1, node2) or
+    dornyPathsFilterTaintStep(node1, node2) or
+    tjActionsChangedFilesTaintStep(node1, node2) or
+    tjActionsVerifyChangedFilesTaintStep(node1, node2)
   }
 }

ql/lib/ext/tj-actions_changed-files.model.yml

@@ -455,24 +455,6 @@ sources
 | tj-actions/branch-names | * | output.current_branch | branch | manual |
 | tj-actions/branch-names | * | output.head_ref_branch | branch | manual |
 | tj-actions/branch-names | * | output.ref_branch | branch | manual |
-| tj-actions/changed-files | * | output.added_files | filename | manual |
-| tj-actions/changed-files | * | output.all_changed_and_modified_files | filename | manual |
-| tj-actions/changed-files | * | output.all_changed_files | filename | manual |
-| tj-actions/changed-files | * | output.all_modified_files | filename | manual |
-| tj-actions/changed-files | * | output.all_old_new_renamed_files | filename | manual |
-| tj-actions/changed-files | * | output.changed_keys | filename | manual |
-| tj-actions/changed-files | * | output.copied_files | filename | manual |
-| tj-actions/changed-files | * | output.deleted_files | filename | manual |
-| tj-actions/changed-files | * | output.modified_files | filename | manual |
-| tj-actions/changed-files | * | output.modified_keys | filename | manual |
-| tj-actions/changed-files | * | output.other_changed_files | filename | manual |
-| tj-actions/changed-files | * | output.other_deleted_files | filename | manual |
-| tj-actions/changed-files | * | output.other_modified_files | filename | manual |
-| tj-actions/changed-files | * | output.renamed_files | filename | manual |
-| tj-actions/changed-files | * | output.type_changed_files | filename | manual |
-| tj-actions/changed-files | * | output.unknown_files | filename | manual |
-| tj-actions/changed-files | * | output.unmerged_files | filename | manual |
-| tj-actions/verify-changed-files | * | output.changed-files | filename | manual |
 | trilom/file-changes-action | * | output.files | filename | manual |
 | trilom/file-changes-action | * | output.files_added | filename | manual |
 | trilom/file-changes-action | * | output.files_modified | filename | manual |

ql/lib/ext/tj-actions_verify-changed-files.model.yml

@@ -2,8 +2,6 @@ name: CI
 
 on:
   pull_request:
-    branches:
-      - main
 
 jobs:
   changed_files:
@@ -13,13 +11,50 @@ jobs:
       - uses: actions/checkout@v4
         with:
           fetch-depth: 0
-      - name: Get changed files
-        id: changed-files
+
+      - name: Get changed files 1
+        id: changed-files1
         uses: tj-actions/changed-files@v40
+      - name: List all changed files 1
+        run: |
+          for file in ${{ steps.changed-files1.outputs.all_changed_files }}; do
+            echo "$file was changed"
+          done
+
+      - name: Get changed files 2
+        id: changed-files2
+        uses: tj-actions/changed-files@v41
+      - name: List all changed files 2
+        run: |
+          for file in ${{ steps.changed-files2.outputs.all_changed_files }}; do
+            echo "$file was changed"
+          done
 
-      - name: List all changed files
+      - name: Get changed files 3
+        id: changed-files3
+        uses: tj-actions/changed-files@v41
+        with:
+          safe_output: false
+      - name: List all changed files 3
+        run: |
+          for file in ${{ steps.changed-files3.outputs.all_changed_files }}; do
+            echo "$file was changed"
+          done
+
+      - name: Get changed files 4
+        id: changed-files4
+        uses: tj-actions/changed-files@0874344d6ebbaa00a27da73276ae7162fadcaf69 # v44.3.0
+      - name: List all changed files 4
         run: |
-          for file in ${{ steps.changed-files.outputs.all_changed_files }}; do
+          for file in ${{ steps.changed-files4.outputs.all_changed_files }}; do
             echo "$file was changed"
           done
 
+      - name: Get changed files 5
+        id: changed-files5
+        uses: tj-actions/changed-files@95690f9ece77c1740f4a55b7f1de9023ed6b1f87 # v39.2.3
+      - name: List all changed files 5
+        run: |
+          for file in ${{ steps.changed-files5.outputs.all_changed_files }}; do
+            echo "$file was changed"
+          done