Skip to content

Commit 43211d3

Browse files
author
Alvaro Muñoz
committed
Update tests
1 parent 315ffdf commit 43211d3

6 files changed

Lines changed: 127 additions & 3 deletions

File tree

‎ql/test/query-tests/Security/CWE-077/.github/workflows/test17.yml‎

Lines changed: 36 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,36 @@
1+
on:
2+
push:
3+
branches: [main]
4+
workflow_dispatch:
5+
inputs:
6+
pypi:
7+
type: boolean
8+
description: Publish
9+
10+
jobs:
11+
publish:
12+
runs-on: ubuntu-latest
13+
permissions:
14+
id-token: write
15+
steps:
16+
- name: Checkout code
17+
uses: actions/checkout@v4
18+
with:
19+
token: ${{ secrets._GITHUB_TOKEN }}
20+
- name: Extract PR Details
21+
env:
22+
GH_TOKEN: ${{ secrets._GITHUB_TOKEN }}
23+
run: |
24+
# Check if the event is a pull request or pull_request_target
25+
if [ "${{ github.event_name }}" = "pull_request" ] || [ "${{ github.event_name }}" = "pull_request_target" ]; then
26+
PR_NUMBER=${{ github.event.pull_request.number }}
27+
PR_TITLE=$(gh pr view $PR_NUMBER --json title --jq '.title')
28+
else
29+
# Use gh to find the PR associated with the commit
30+
COMMIT_SHA=${{ github.event.after }}
31+
PR_JSON=$(gh pr list --search "${COMMIT_SHA}" --state merged --json number,title --jq '.[0]')
32+
PR_NUMBER=$(echo $PR_JSON | jq -r '.number')
33+
PR_TITLE=$(echo $PR_JSON | jq -r '.title')
34+
fi
35+
echo "PR_NUMBER=$PR_NUMBER" >> $GITHUB_ENV
36+
echo "PR_TITLE=$PR_TITLE" >> $GITHUB_ENV

‎ql/test/query-tests/Security/CWE-077/.github/workflows/test18.yml‎

Lines changed: 32 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,32 @@
1+
on:
2+
schedule:
3+
- cron: '0 0 * * *'
4+
pull_request:
5+
types: [ opened, synchronize, reopened ]
6+
branches: ["master", "*-rc"]
7+
workflow_dispatch:
8+
9+
jobs:
10+
tests:
11+
runs-on: ubuntu-latest
12+
steps:
13+
- name: Checkout Repository
14+
uses: actions/checkout@692973e3d937129bcbf40652eb9f2f61becf3332 # v4
15+
16+
- name: Set Branch Variables
17+
id: set-branch-variables
18+
env:
19+
github_event_pull_request_head_repo_owner_login: ${{ github.event.pull_request.head.repo.owner.login }}
20+
github_repository_owner: ${{ github.repository_owner }}
21+
run: |
22+
# Set the Repo Owner
23+
REPO_OWNER="${github_event_pull_request_head_repo_owner_login:-$github_repository_owner}"
24+
echo "REPO_OWNER=$REPO_OWNER" >> $GITHUB_ENV
25+
- name: Sanitize Github Variables
26+
id: sanitize-github-variables
27+
env:
28+
GITHUB_EVENT_PULL_REQUEST_TITLE: ${{ github.event.pull_request.title }}
29+
run: |
30+
# Delete non-alphanumeric characters and limit to 75 chars which is the branch title limit in GitHub
31+
SAFE_PULL_REQUEST_TITLE=$(echo "${GITHUB_EVENT_PULL_REQUEST_TITLE}" | tr -cd '[:alnum:]_ -' | cut -c1-75)
32+
echo "SAFE_PULL_REQUEST_TITLE=$SAFE_PULL_REQUEST_TITLE" >> $GITHUB_ENV

‎ql/test/query-tests/Security/CWE-077/.github/workflows/test19.yml‎

Lines changed: 40 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,40 @@
1+
on:
2+
pull_request:
3+
workflow_dispatch:
4+
5+
jobs:
6+
build:
7+
if: ${{ github.repository_owner == 'test' }}
8+
runs-on: ubuntu-latest
9+
steps:
10+
- name: Get the appropriate Endo branch
11+
id: branch
12+
uses: actions/github-script@v7
13+
with:
14+
result-encoding: string
15+
script: |-
16+
let branch = 'NOPE';
17+
if (context.payload.pull_request) {
18+
const { body } = context.payload.pull_request;
19+
const regex = /^\#endo-branch:\s+(\S+)/m;
20+
const result = regex.exec(body);
21+
if (result) {
22+
branch = result[1];
23+
}
24+
}
25+
return branch;
26+
- name: check out
27+
id: checkout
28+
if: steps.branch.outputs.result != 'NOPE'
29+
uses: actions/checkout@v4
30+
with:
31+
repository: test/test
32+
path: ./tmp
33+
ref: ${{ steps.branch.outputs.result }}
34+
clean: 'false'
35+
submodules: 'true'
36+
persist-credentials: false
37+
38+
- name: Find Netlify site ID
39+
run: |
40+
echo "NETLIFY_SITE_ID=$(cat COVERAGE_NETLIFY_SITE_ID)" >> $GITHUB_ENV

‎ql/test/query-tests/Security/CWE-094/.github/workflows/test20.yml‎

Lines changed: 19 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,19 @@
1+
2+
on: [ workflow_dispatch, pull_request ]
3+
jobs:
4+
test:
5+
runs-on: ubuntu-20.04
6+
steps:
7+
- name: Preliminary Information
8+
run: |
9+
echo "The job was automatically triggered by a ${{ github.event_name }} event."
10+
echo "This job is now running on a ${{ runner.os }} server hosted by GitHub!"
11+
echo "The name of your branch is ${{ github.ref }} and your repository is ${{ github.repository }}."
12+
echo " "
13+
echo "github.ref = ${{ github.ref }}"
14+
echo "github.sha = ${{ github.sha }}"
15+
echo "github.event.pull_request.head.ref = ${{ github.event.pull_request.head.ref }}"
16+
echo "github.event.pull_request.head.sha = ${{ github.event.pull_request.head.sha }}"
17+
echo "github.event.pull_request.base.ref = ${{ github.event.pull_request.base.ref }}"
18+
echo "github.event.pull_request.base.sha = ${{ github.event.pull_request.base.sha }}"
19+
echo " "

‎ql/test/query-tests/Security/CWE-094/CodeInjectionCritical.expected‎

Lines changed: 0 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -360,7 +360,6 @@ nodes
360360
| .github/workflows/level0.yml:44:20:44:49 | github.event.issue.body | semmle.label | github.event.issue.body |
361361
| .github/workflows/level0.yml:69:35:69:66 | github.event.comment.body | semmle.label | github.event.comment.body |
362362
| .github/workflows/level1.yml:37:38:37:81 | github.event.workflow_run.head_branch | semmle.label | github.event.workflow_run.head_branch |
363-
| .github/workflows/priv_pull_request.yml:14:21:14:57 | github.event.pull_request.body | semmle.label | github.event.pull_request.body |
364363
| .github/workflows/pull_request_review.yml:7:19:7:56 | github.event.pull_request.title | semmle.label | github.event.pull_request.title |
365364
| .github/workflows/pull_request_review.yml:8:19:8:55 | github.event.pull_request.body | semmle.label | github.event.pull_request.body |
366365
| .github/workflows/pull_request_review.yml:9:19:9:61 | github.event.pull_request.head.label | semmle.label | github.event.pull_request.head.label |

‎ql/test/query-tests/Security/CWE-094/CodeInjectionMedium.expected‎

Lines changed: 0 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -360,7 +360,6 @@ nodes
360360
| .github/workflows/level0.yml:44:20:44:49 | github.event.issue.body | semmle.label | github.event.issue.body |
361361
| .github/workflows/level0.yml:69:35:69:66 | github.event.comment.body | semmle.label | github.event.comment.body |
362362
| .github/workflows/level1.yml:37:38:37:81 | github.event.workflow_run.head_branch | semmle.label | github.event.workflow_run.head_branch |
363-
| .github/workflows/priv_pull_request.yml:14:21:14:57 | github.event.pull_request.body | semmle.label | github.event.pull_request.body |
364363
| .github/workflows/pull_request_review.yml:7:19:7:56 | github.event.pull_request.title | semmle.label | github.event.pull_request.title |
365364
| .github/workflows/pull_request_review.yml:8:19:8:55 | github.event.pull_request.body | semmle.label | github.event.pull_request.body |
366365
| .github/workflows/pull_request_review.yml:9:19:9:61 | github.event.pull_request.head.label | semmle.label | github.event.pull_request.head.label |
@@ -628,7 +627,6 @@ subpaths
628627
| .github/workflows/inter-job1.yml:43:20:43:53 | needs.job1.outputs.job_output | .github/workflows/inter-job1.yml:22:9:26:6 | Uses Step: source | .github/workflows/inter-job1.yml:43:20:43:53 | needs.job1.outputs.job_output | Potential code injection in $@, which may be controlled by an external user. | .github/workflows/inter-job1.yml:43:20:43:53 | needs.job1.outputs.job_output | ${{needs.job1.outputs.job_output}} |
629628
| .github/workflows/inter-job2.yml:45:20:45:53 | needs.job1.outputs.job_output | .github/workflows/inter-job2.yml:22:9:26:6 | Uses Step: source | .github/workflows/inter-job2.yml:45:20:45:53 | needs.job1.outputs.job_output | Potential code injection in $@, which may be controlled by an external user. | .github/workflows/inter-job2.yml:45:20:45:53 | needs.job1.outputs.job_output | ${{needs.job1.outputs.job_output}} |
630629
| .github/workflows/inter-job4.yml:44:20:44:53 | needs.job1.outputs.job_output | .github/workflows/inter-job4.yml:22:9:26:6 | Uses Step: source | .github/workflows/inter-job4.yml:44:20:44:53 | needs.job1.outputs.job_output | Potential code injection in $@, which may be controlled by an external user. | .github/workflows/inter-job4.yml:44:20:44:53 | needs.job1.outputs.job_output | ${{needs.job1.outputs.job_output}} |
631-
| .github/workflows/priv_pull_request.yml:14:21:14:57 | github.event.pull_request.body | .github/workflows/priv_pull_request.yml:14:21:14:57 | github.event.pull_request.body | .github/workflows/priv_pull_request.yml:14:21:14:57 | github.event.pull_request.body | Potential code injection in $@, which may be controlled by an external user. | .github/workflows/priv_pull_request.yml:14:21:14:57 | github.event.pull_request.body | ${{ github.event.pull_request.body }} |
632630
| .github/workflows/push.yml:7:19:7:57 | github.event.commits[11].message | .github/workflows/push.yml:7:19:7:57 | github.event.commits[11].message | .github/workflows/push.yml:7:19:7:57 | github.event.commits[11].message | Potential code injection in $@, which may be controlled by an external user. | .github/workflows/push.yml:7:19:7:57 | github.event.commits[11].message | ${{ github.event.commits[11].message }} |
633631
| .github/workflows/push.yml:8:19:8:62 | github.event.commits[11].author.email | .github/workflows/push.yml:8:19:8:62 | github.event.commits[11].author.email | .github/workflows/push.yml:8:19:8:62 | github.event.commits[11].author.email | Potential code injection in $@, which may be controlled by an external user. | .github/workflows/push.yml:8:19:8:62 | github.event.commits[11].author.email | ${{ github.event.commits[11].author.email }} |
634632
| .github/workflows/push.yml:9:19:9:61 | github.event.commits[11].author.name | .github/workflows/push.yml:9:19:9:61 | github.event.commits[11].author.name | .github/workflows/push.yml:9:19:9:61 | github.event.commits[11].author.name | Potential code injection in $@, which may be controlled by an external user. | .github/workflows/push.yml:9:19:9:61 | github.event.commits[11].author.name | ${{ github.event.commits[11].author.name }} |

0 commit comments

Comments
 (0)