Fix LabelIf ControlCheck so that it recognizes checks not at the beginning of the expression

Alvaro Muñoz · Alvaro Muñoz · commit 922ae57abaf8 · 2024-10-25T10:26:47.000+02:00
diff --git a/ql/lib/codeql/actions/security/ControlChecks.qll b/ql/lib/codeql/actions/security/ControlChecks.qll
@@ -165,7 +165,7 @@ class LabelIfCheck extends LabelCheck instanceof If {
     condition = normalizeExpr(this.getCondition()) and
     (
       // eg: contains(github.event.pull_request.labels.*.name, 'safe to test')
-      condition.regexpMatch("(^|[^!])contains\\(\\s*github\\.event\\.pull_request\\.labels\\b.*")
+      condition.regexpMatch(".*(^|[^!])contains\\(\\s*github\\.event\\.pull_request\\.labels\\b.*")
       or
       // eg: github.event.label.name == 'safe to test'
       condition.regexpMatch(".*\\bgithub\\.event\\.label\\.name\\s*==.*")

Original file line number	Diff line number	Diff line change
`@@ -165,7 +165,7 @@ class LabelIfCheck extends LabelCheck instanceof If {`
`165`	`165`	`condition = normalizeExpr(this.getCondition()) and`
`166`	`166`	`(`
`167`	`167`	`// eg: contains(github.event.pull_request.labels.*.name, 'safe to test')`
`168`		`- condition.regexpMatch("(^\|[^!])contains\\(\\sgithub\\.event\\.pull_request\\.labels\\b.")`
	`168`	`+ condition.regexpMatch(".(^\|[^!])contains\\(\\sgithub\\.event\\.pull_request\\.labels\\b.*")`
`169`	`169`	`or`
`170`	`170`	`// eg: github.event.label.name == 'safe to test'`
`171`	`171`	`condition.regexpMatch(".\\bgithub\\.event\\.label\\.name\\s==.*")`