Skip to content

Commit ae6309d

Browse files
author
Alvaro Muñoz
committed
Account for tar -C option to specify path
1 parent 674afc5 commit ae6309d

5 files changed

Lines changed: 59 additions & 7 deletions

File tree

‎ql/lib/codeql/actions/security/ArtifactPoisoningQuery.qll‎

Lines changed: 7 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -4,9 +4,9 @@ import codeql.actions.DataFlow
44
import codeql.actions.dataflow.FlowSources
55
import codeql.actions.security.PoisonableSteps
66

7-
string unzipRegexp() { result = ".*(unzip|tar)\\s+.*" }
7+
string unzipRegexp() { result = "(unzip|tar)\\s+.*" }
88

9-
string unzipDirArgRegexp() { result = "-d\\s+([^ ]+).*" }
9+
string unzipDirArgRegexp() { result = "(-d|-C)\\s+([^ ]+).*" }
1010

1111
abstract class UntrustedArtifactDownloadStep extends Step {
1212
abstract string getPath();
@@ -166,7 +166,7 @@ class ActionsGitHubScriptDownloadStep extends UntrustedArtifactDownloadStep, Use
166166
.(Run)
167167
.getScript()
168168
.getACommand()
169-
.regexpCapture(unzipRegexp() + unzipDirArgRegexp(), 2)))
169+
.regexpCapture(unzipRegexp() + unzipDirArgRegexp(), 3)))
170170
else
171171
if this.getAFollowingStep().(Run).getScript().getACommand().regexpMatch(unzipRegexp())
172172
then result = "GITHUB_WORKSPACE/"
@@ -197,13 +197,13 @@ class GHRunArtifactDownloadStep extends UntrustedArtifactDownloadStep, Run {
197197
result =
198198
normalizePath(trimQuotes(this.getScript()
199199
.getACommand()
200-
.regexpCapture(unzipRegexp() + unzipDirArgRegexp(), 2))) or
200+
.regexpCapture(unzipRegexp() + unzipDirArgRegexp(), 3))) or
201201
result =
202202
normalizePath(trimQuotes(this.getAFollowingStep()
203203
.(Run)
204204
.getScript()
205205
.getACommand()
206-
.regexpCapture(unzipRegexp() + unzipDirArgRegexp(), 2)))
206+
.regexpCapture(unzipRegexp() + unzipDirArgRegexp(), 3)))
207207
else
208208
if
209209
this.getAFollowingStep().(Run).getScript().getACommand().regexpMatch(unzipRegexp()) or
@@ -243,13 +243,13 @@ class DirectArtifactDownloadStep extends UntrustedArtifactDownloadStep, Run {
243243
result =
244244
normalizePath(trimQuotes(this.getScript()
245245
.getACommand()
246-
.regexpCapture(unzipRegexp() + unzipDirArgRegexp(), 2))) or
246+
.regexpCapture(unzipRegexp() + unzipDirArgRegexp(), 3))) or
247247
result =
248248
normalizePath(trimQuotes(this.getAFollowingStep()
249249
.(Run)
250250
.getScript()
251251
.getACommand()
252-
.regexpCapture(unzipRegexp() + unzipDirArgRegexp(), 2)))
252+
.regexpCapture(unzipRegexp() + unzipDirArgRegexp(), 3)))
253253
else result = "GITHUB_WORKSPACE/"
254254
}
255255
}

‎ql/test/query-tests/Security/CWE-829/.github/workflows/test25.yml‎

Lines changed: 42 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,42 @@
1+
on:
2+
workflow_run:
3+
workflows: [ "build" ]
4+
types: [ completed ]
5+
6+
defaults:
7+
run:
8+
shell: bash
9+
10+
jobs:
11+
publish-build-scans:
12+
name: Build scan publish
13+
if: github.repository == 'test/test' && github.event.workflow_run.event == 'pull_request' && github.event.workflow_run.conclusion != 'cancelled'
14+
runs-on: ubuntu-latest
15+
steps:
16+
# Checkout target branch which has trusted code
17+
- name: Check out target branch
18+
uses: actions/checkout@v4
19+
with:
20+
persist-credentials: false
21+
ref: ${{ github.ref }}
22+
- name: Download build scan
23+
id: downloadBuildScan
24+
uses: actions/download-artifact@v4
25+
with:
26+
name: build-scan
27+
github-token: ${{ github.token }}
28+
repository: ${{ github.repository }}
29+
run-id: ${{ github.event.workflow_run.id }}
30+
# Don't fail a build if the file doesn't exist
31+
continue-on-error: true
32+
- name: Extract previously uploaded build scan content
33+
if: ${{ steps.downloadBuildScan.outcome != 'failure'}}
34+
run: tar -xzf build-scan.tgz -C ~
35+
- name: Publish
36+
if: ${{ steps.downloadBuildScan.outcome != 'failure'}}
37+
# Don't fail a build if publishing fails
38+
continue-on-error: true
39+
run: |
40+
./gradlew buildScanPublishPrevious
41+
env:
42+
ACCESS_KEY: ${{ secrets.TEST_ACCESS_KEY }}

‎ql/test/query-tests/Security/CWE-829/ArtifactPoisoningCritical.expected‎

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -15,6 +15,7 @@ edges
1515
| .github/workflows/artifactpoisoning81.yml:28:9:31:6 | Uses Step | .github/workflows/artifactpoisoning81.yml:31:14:31:27 | python test.py | provenance | Config |
1616
| .github/workflows/artifactpoisoning101.yml:10:9:16:6 | Uses Step | .github/workflows/artifactpoisoning101.yml:17:14:19:59 | PR_NUMBER=$(./get_pull_request_number.sh pr_number.txt)\necho "PR_NUMBER=$PR_NUMBER" >> $GITHUB_OUTPUT \n | provenance | Config |
1717
| .github/workflows/test18.yml:12:15:33:12 | Uses Step | .github/workflows/test18.yml:36:15:40:58 | Uses Step | provenance | Config |
18+
| .github/workflows/test25.yml:22:9:32:6 | Uses Step: downloadBuildScan | .github/workflows/test25.yml:39:14:40:45 | ./gradlew buildScanPublishPrevious\n | provenance | Config |
1819
nodes
1920
| .github/actions/download-artifact-2/action.yaml:6:7:25:4 | Uses Step | semmle.label | Uses Step |
2021
| .github/workflows/artifactpoisoning11.yml:13:9:32:6 | Uses Step | semmle.label | Uses Step |
@@ -47,6 +48,8 @@ nodes
4748
| .github/workflows/artifactpoisoning101.yml:17:14:19:59 | PR_NUMBER=$(./get_pull_request_number.sh pr_number.txt)\necho "PR_NUMBER=$PR_NUMBER" >> $GITHUB_OUTPUT \n | semmle.label | PR_NUMBER=$(./get_pull_request_number.sh pr_number.txt)\necho "PR_NUMBER=$PR_NUMBER" >> $GITHUB_OUTPUT \n |
4849
| .github/workflows/test18.yml:12:15:33:12 | Uses Step | semmle.label | Uses Step |
4950
| .github/workflows/test18.yml:36:15:40:58 | Uses Step | semmle.label | Uses Step |
51+
| .github/workflows/test25.yml:22:9:32:6 | Uses Step: downloadBuildScan | semmle.label | Uses Step: downloadBuildScan |
52+
| .github/workflows/test25.yml:39:14:40:45 | ./gradlew buildScanPublishPrevious\n | semmle.label | ./gradlew buildScanPublishPrevious\n |
5053
subpaths
5154
#select
5255
| .github/workflows/artifactpoisoning11.yml:38:11:38:77 | ./sonarcloud-data/x.py build -j$(nproc) --compiler gcc --skip-build | .github/workflows/artifactpoisoning11.yml:13:9:32:6 | Uses Step | .github/workflows/artifactpoisoning11.yml:38:11:38:77 | ./sonarcloud-data/x.py build -j$(nproc) --compiler gcc --skip-build | Potential artifact poisoning in $@, which may be controlled by an external user. | .github/workflows/artifactpoisoning11.yml:38:11:38:77 | ./sonarcloud-data/x.py build -j$(nproc) --compiler gcc --skip-build | ./sonarcloud-data/x.py build -j$(nproc) --compiler gcc --skip-build |
@@ -65,3 +68,4 @@ subpaths
6568
| .github/workflows/artifactpoisoning92.yml:29:14:29:26 | make snapshot | .github/actions/download-artifact-2/action.yaml:6:7:25:4 | Uses Step | .github/workflows/artifactpoisoning92.yml:29:14:29:26 | make snapshot | Potential artifact poisoning in $@, which may be controlled by an external user. | .github/workflows/artifactpoisoning92.yml:29:14:29:26 | make snapshot | make snapshot |
6669
| .github/workflows/artifactpoisoning101.yml:17:14:19:59 | PR_NUMBER=$(./get_pull_request_number.sh pr_number.txt)\necho "PR_NUMBER=$PR_NUMBER" >> $GITHUB_OUTPUT \n | .github/workflows/artifactpoisoning101.yml:10:9:16:6 | Uses Step | .github/workflows/artifactpoisoning101.yml:17:14:19:59 | PR_NUMBER=$(./get_pull_request_number.sh pr_number.txt)\necho "PR_NUMBER=$PR_NUMBER" >> $GITHUB_OUTPUT \n | Potential artifact poisoning in $@, which may be controlled by an external user. | .github/workflows/artifactpoisoning101.yml:17:14:19:59 | PR_NUMBER=$(./get_pull_request_number.sh pr_number.txt)\necho "PR_NUMBER=$PR_NUMBER" >> $GITHUB_OUTPUT \n | PR_NUMBER=$(./get_pull_request_number.sh pr_number.txt)\necho "PR_NUMBER=$PR_NUMBER" >> $GITHUB_OUTPUT \n |
6770
| .github/workflows/test18.yml:36:15:40:58 | Uses Step | .github/workflows/test18.yml:12:15:33:12 | Uses Step | .github/workflows/test18.yml:36:15:40:58 | Uses Step | Potential artifact poisoning in $@, which may be controlled by an external user. | .github/workflows/test18.yml:36:15:40:58 | Uses Step | Uses Step |
71+
| .github/workflows/test25.yml:39:14:40:45 | ./gradlew buildScanPublishPrevious\n | .github/workflows/test25.yml:22:9:32:6 | Uses Step: downloadBuildScan | .github/workflows/test25.yml:39:14:40:45 | ./gradlew buildScanPublishPrevious\n | Potential artifact poisoning in $@, which may be controlled by an external user. | .github/workflows/test25.yml:39:14:40:45 | ./gradlew buildScanPublishPrevious\n | ./gradlew buildScanPublishPrevious\n |

‎ql/test/query-tests/Security/CWE-829/ArtifactPoisoningMedium.expected‎

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -15,6 +15,7 @@ edges
1515
| .github/workflows/artifactpoisoning81.yml:28:9:31:6 | Uses Step | .github/workflows/artifactpoisoning81.yml:31:14:31:27 | python test.py | provenance | Config |
1616
| .github/workflows/artifactpoisoning101.yml:10:9:16:6 | Uses Step | .github/workflows/artifactpoisoning101.yml:17:14:19:59 | PR_NUMBER=$(./get_pull_request_number.sh pr_number.txt)\necho "PR_NUMBER=$PR_NUMBER" >> $GITHUB_OUTPUT \n | provenance | Config |
1717
| .github/workflows/test18.yml:12:15:33:12 | Uses Step | .github/workflows/test18.yml:36:15:40:58 | Uses Step | provenance | Config |
18+
| .github/workflows/test25.yml:22:9:32:6 | Uses Step: downloadBuildScan | .github/workflows/test25.yml:39:14:40:45 | ./gradlew buildScanPublishPrevious\n | provenance | Config |
1819
nodes
1920
| .github/actions/download-artifact-2/action.yaml:6:7:25:4 | Uses Step | semmle.label | Uses Step |
2021
| .github/workflows/artifactpoisoning11.yml:13:9:32:6 | Uses Step | semmle.label | Uses Step |
@@ -47,5 +48,7 @@ nodes
4748
| .github/workflows/artifactpoisoning101.yml:17:14:19:59 | PR_NUMBER=$(./get_pull_request_number.sh pr_number.txt)\necho "PR_NUMBER=$PR_NUMBER" >> $GITHUB_OUTPUT \n | semmle.label | PR_NUMBER=$(./get_pull_request_number.sh pr_number.txt)\necho "PR_NUMBER=$PR_NUMBER" >> $GITHUB_OUTPUT \n |
4849
| .github/workflows/test18.yml:12:15:33:12 | Uses Step | semmle.label | Uses Step |
4950
| .github/workflows/test18.yml:36:15:40:58 | Uses Step | semmle.label | Uses Step |
51+
| .github/workflows/test25.yml:22:9:32:6 | Uses Step: downloadBuildScan | semmle.label | Uses Step: downloadBuildScan |
52+
| .github/workflows/test25.yml:39:14:40:45 | ./gradlew buildScanPublishPrevious\n | semmle.label | ./gradlew buildScanPublishPrevious\n |
5053
subpaths
5154
#select

‎ql/test/query-tests/Security/CWE-829/UntrustedCheckoutCritical.expected‎

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -276,6 +276,9 @@ edges
276276
| .github/workflows/test23.yml:38:9:43:6 | Uses Step | .github/workflows/test23.yml:43:9:46:16 | Run Step |
277277
| .github/workflows/test24.yml:7:9:10:6 | Uses Step | .github/workflows/test24.yml:10:9:16:6 | Run Step |
278278
| .github/workflows/test24.yml:10:9:16:6 | Run Step | .github/workflows/test24.yml:16:9:20:57 | Run Step |
279+
| .github/workflows/test25.yml:17:9:22:6 | Uses Step | .github/workflows/test25.yml:22:9:32:6 | Uses Step: downloadBuildScan |
280+
| .github/workflows/test25.yml:22:9:32:6 | Uses Step: downloadBuildScan | .github/workflows/test25.yml:32:9:35:6 | Run Step |
281+
| .github/workflows/test25.yml:32:9:35:6 | Run Step | .github/workflows/test25.yml:35:9:42:53 | Run Step |
279282
| .github/workflows/test.yml:13:9:14:6 | Uses Step | .github/workflows/test.yml:14:9:25:6 | Run Step |
280283
| .github/workflows/test.yml:14:9:25:6 | Run Step | .github/workflows/test.yml:25:9:33:6 | Run Step |
281284
| .github/workflows/test.yml:25:9:33:6 | Run Step | .github/workflows/test.yml:33:9:37:34 | Run Step |

0 commit comments

Comments
 (0)