Skip to content

Commit 2d5cd1a

Browse files
KyFaStKyFaSt
committed
WIP. todo: modify help text in query to be helpful, write qlhelp file, find out how to not release to customers
1 parent e550834 commit 2d5cd1a

6 files changed

Lines changed: 38 additions & 26 deletions

File tree

‎ql/lib/codeql/actions/config/Config.qll‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -120,7 +120,7 @@ predicate vulnerableActionsDataModel(
120120
}
121121

122122
/**
123-
* MaD models for vulnerable actions
123+
* MaD models for immutable actions
124124
* Fields:
125125
* - action: action name
126126
*/

‎ql/lib/codeql/actions/security/UseOfUnversionedImmutableAction.qll‎

Lines changed: 11 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,11 @@
1+
import actions
2+
3+
class UnversionedImmutableAction extends UsesStep {
4+
string immutable_action;
5+
6+
UnversionedImmutableAction() {
7+
immutableActionsDataModel(immutable_action) and
8+
this.getCallee() = immutable_action and
9+
not this.getVersion().regexpMatch("^(v)?[0-9]+(\\.[0-9]+)*(\\.[xX])?$")
10+
}
11+
}

‎ql/src/Security/CWE-829/UnversionedImmutableAction.ql‎

Lines changed: 5 additions & 24 deletions
Original file line numberDiff line numberDiff line change
@@ -2,7 +2,6 @@
22
* @name Unversioned Immutable Action
33
* @description Using an Immutable Action without a semantic version tag opts out of the protections of Immutable Action
44
* @kind problem
5-
* @security-severity 5.0
65
* @problem.severity recommendation
76
* @precision high
87
* @id actions/unversioned-immutable-action
@@ -12,27 +11,9 @@
1211
*/
1312

1413
import actions
14+
import codeql.actions.security.UseOfUnversionedImmutableAction
1515

16-
bindingset[version]
17-
private predicate isSemanticVersioned(string version) { version.regexpMatch("^v[0-9]+(\\.[0-9]+)*(\\.[xX])?$") }
18-
19-
bindingset[repo]
20-
private predicate isTrustedOrg(string repo) {
21-
exists(string org | org in ["actions", "github", "advanced-security", "octokit"] | repo.matches(org + "/%"))
22-
}
23-
24-
from UsesStep uses, string repo, string version, Workflow workflow, string name
25-
where
26-
uses.getCallee() = repo and
27-
uses.getEnclosingWorkflow() = workflow and
28-
(
29-
workflow.getName() = name
30-
or
31-
not exists(workflow.getName()) and workflow.getLocation().getFile().getBaseName() = name
32-
) and
33-
uses.getVersion() = version and
34-
not isTrustedOrg(repo) and
35-
not isPinnedCommit(version)
36-
select uses.getCalleeNode(),
37-
"Unpinned 3rd party Action '" + name + "' step $@ uses '" + repo + "' with ref '" + version +
38-
"', not a pinned commit hash", uses, uses.toString()
16+
from UnversionedImmutableAction step
17+
select step,
18+
"The workflow is using an immutable action ($@) without versinoning so it doesn't work", step,
19+
step.getCallee()

‎ql/test/query-tests/Security/CWE-829/.github/actions/dangerous-git-checkout/action.yml‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -4,7 +4,7 @@ runs:
44
using: "composite"
55
steps:
66
- name: Checkout repo
7-
uses: actions/checkout@v4
7+
uses: actions/checkout@4
88
with:
99
ref: ${{ github.event.pull_request.head.sha }}
1010
fetch-depth: 2

‎ql/test/query-tests/Security/CWE-829/UnversionedImmutableAction.expected‎

Lines changed: 19 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,19 @@
1+
| .github/actions/download-artifact-2/action.yaml:6:7:25:4 | Uses Step | The workflow is using an immutable action ($@) without versinoning so it doesn't work | .github/actions/download-artifact-2/action.yaml:6:7:25:4 | Uses Step | actions/github-script |
2+
| .github/actions/download-artifact/action.yaml:6:7:25:4 | Uses Step | The workflow is using an immutable action ($@) without versinoning so it doesn't work | .github/actions/download-artifact/action.yaml:6:7:25:4 | Uses Step | actions/github-script |
3+
| .github/workflows/artifactpoisoning91.yml:17:9:18:6 | Uses Step | The workflow is using an immutable action ($@) without versinoning so it doesn't work | .github/workflows/artifactpoisoning91.yml:17:9:18:6 | Uses Step | actions/checkout |
4+
| .github/workflows/artifactpoisoning91.yml:25:9:28:6 | Uses Step | The workflow is using an immutable action ($@) without versinoning so it doesn't work | .github/workflows/artifactpoisoning91.yml:25:9:28:6 | Uses Step | actions/checkout |
5+
| .github/workflows/artifactpoisoning92.yml:17:9:18:6 | Uses Step | The workflow is using an immutable action ($@) without versinoning so it doesn't work | .github/workflows/artifactpoisoning92.yml:17:9:18:6 | Uses Step | actions/checkout |
6+
| .github/workflows/artifactpoisoning92.yml:25:9:28:6 | Uses Step | The workflow is using an immutable action ($@) without versinoning so it doesn't work | .github/workflows/artifactpoisoning92.yml:25:9:28:6 | Uses Step | actions/checkout |
7+
| .github/workflows/poc.yml:30:9:36:6 | Uses Step | The workflow is using an immutable action ($@) without versinoning so it doesn't work | .github/workflows/poc.yml:30:9:36:6 | Uses Step | actions/checkout |
8+
| .github/workflows/poc.yml:36:9:38:6 | Uses Step | The workflow is using an immutable action ($@) without versinoning so it doesn't work | .github/workflows/poc.yml:36:9:38:6 | Uses Step | actions/configure-pages |
9+
| .github/workflows/poc.yml:43:9:47:2 | Uses Step | The workflow is using an immutable action ($@) without versinoning so it doesn't work | .github/workflows/poc.yml:43:9:47:2 | Uses Step | actions/upload-pages-artifact |
10+
| .github/workflows/poc.yml:59:9:63:26 | Uses Step: deployment | The workflow is using an immutable action ($@) without versinoning so it doesn't work | .github/workflows/poc.yml:59:9:63:26 | Uses Step: deployment | actions/deploy-pages |
11+
| .github/workflows/priv_pull_request_checkout.yml:14:9:20:6 | Uses Step | The workflow is using an immutable action ($@) without versinoning so it doesn't work | .github/workflows/priv_pull_request_checkout.yml:14:9:20:6 | Uses Step | actions/checkout |
12+
| .github/workflows/test8.yml:20:9:26:6 | Uses Step | The workflow is using an immutable action ($@) without versinoning so it doesn't work | .github/workflows/test8.yml:20:9:26:6 | Uses Step | actions/checkout |
13+
| .github/workflows/test9.yml:11:9:16:6 | Uses Step | The workflow is using an immutable action ($@) without versinoning so it doesn't work | .github/workflows/test9.yml:11:9:16:6 | Uses Step | actions/checkout |
14+
| .github/workflows/test11.yml:84:7:90:4 | Uses Step | The workflow is using an immutable action ($@) without versinoning so it doesn't work | .github/workflows/test11.yml:84:7:90:4 | Uses Step | actions/checkout |
15+
| .github/workflows/test12.yml:86:7:92:4 | Uses Step | The workflow is using an immutable action ($@) without versinoning so it doesn't work | .github/workflows/test12.yml:86:7:92:4 | Uses Step | actions/checkout |
16+
| .github/workflows/test14.yml:101:7:105:4 | Uses Step | The workflow is using an immutable action ($@) without versinoning so it doesn't work | .github/workflows/test14.yml:101:7:105:4 | Uses Step | actions/checkout |
17+
| .github/workflows/test14.yml:105:7:111:4 | Uses Step | The workflow is using an immutable action ($@) without versinoning so it doesn't work | .github/workflows/test14.yml:105:7:111:4 | Uses Step | actions/checkout |
18+
| .github/workflows/test15.yml:60:7:65:4 | Uses Step | The workflow is using an immutable action ($@) without versinoning so it doesn't work | .github/workflows/test15.yml:60:7:65:4 | Uses Step | actions/checkout |
19+
| .github/workflows/test15.yml:110:7:115:4 | Uses Step | The workflow is using an immutable action ($@) without versinoning so it doesn't work | .github/workflows/test15.yml:110:7:115:4 | Uses Step | actions/checkout |

‎ql/test/query-tests/Security/CWE-829/UnversionedImmutableAction.qlref‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1 @@
1+
Security/CWE-829/UnversionedImmutableAction.ql

0 commit comments

Comments
 (0)