codeql/actions/ql/lib/ext/config/poisonable_steps.yml at 1233d81523e40bec36476573ac2b4dcbcd82dc85 · github/codeql · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
extensions:
  - addsTo:
      pack: codeql/actions-all
      extensible: poisonableActionsDataModel
    # source: https://boostsecurityio.github.io/lotp/
    data:
      - ["azure/powershell"]
      - ["pre-commit/action"]
      - ["oxsecurity/megalinter"]
      - ["bridgecrewio/checkov-action"]
      - ["ruby/setup-ruby"]
      - ["actions/jekyll-build-pages"]
      - ["qcastel/github-actions-maven/actions/maven"]
      - ["sonarsource/sonarcloud-github-action"]
  - addsTo:
      pack: codeql/actions-all
      extensible: poisonableCommandsDataModel
    # source: https://boostsecurityio.github.io/lotp/
    data:
      - ["ant"]
      - ["asv"]
      - ["awk\\s+-f"]
      - ["bundle"]
      - ["bun"]
      - ["cargo"]
      - ["checkov"]
      - ["eslint"]
      - ["gcloud\\s+builds submit"]
      - ["golangci-lint"]
      - ["gomplate"]
      - ["goreleaser"]
      - ["gradle"]
      - ["java\\s+-jar"]
      - ["make"]
      - ["mdformat"]
      - ["mkdocs"]
      - ["msbuild"]
      - ["mvn"]
      - ["mypy"]
      - ["(p)?npm\\s+[a-z]"]
      - ["pre-commit"]
      - ["prettier"]
      - ["phpstan"]
      - ["pip\\s+install(.*)\\s+-r"]
      - ["pip\\s+install(.*)\\s+--requirement"]
      - ["pip(x)?\\s+install(.*)\\s+\\."]
      - ["poetry"]
      - ["pylint"]
      - ["pytest"]
      - ["python[\\d\\.]*\\s+-m\\s+pip\\s+install\\s+-r"]
      - ["python[\\d\\.]*\\s+-m\\s+pip\\s+install\\s+--requirement"]
      - ["rake"]
      - ["rails\\s+db:create"]
      - ["rails\\s+assets:precompile"]
      - ["rubocop"]
      - ["sed\\s+-f"]
      - ["sonar-scanner"]
      - ["stylelint"]
      - ["terraform"]
      - ["tflint"]
      - ["yarn"]
      - ["webpack"]
  - addsTo:
      pack: codeql/actions-all
      extensible: poisonableLocalScriptsDataModel
    data:
      # TODO: It could also be in the form of `dir/cmd`
      - ["(\\.\\/[^\\s]+)\\b", 1] # eg: ./venv/bin/activate
      - ["(\\.\\s+[^\\s]+)\\b", 1] # eg: . venv/bin/activate
      - ["(source|sh|bash|zsh|fish)\\s+([^\\s]+)\\b", 2]
      - ["(node)\\s+([^\\s]+)(\\.js|\\.ts)\\b", 2]
      - ["(python[\\d\\.]*)\\s+([^\\s]+)\\.py\\b", 2]
      - ["(python[\\d\\.]*)\\s+([\\-m]+)\\s+(\\w+)\\b", 2] # eg: pythonX -m anything(dir or file)
      - ["(ruby)\\s+([^\\s]+)\\.rb\\b", 2]
      - ["(go)\\s+(generate|run)\\s+([^\\s]+)", 3]
      - ["(dotnet)\\s+([^\\s]+)\\.csproj\\b", 2]