Skip to content

Commit c5c3cd1

Browse files
author
Alvaro Muñoz
committed
Clean imports
1 parent b49cd3b commit c5c3cd1

33 files changed

Lines changed: 52 additions & 33 deletions

‎ql/lib/codeql/actions/security/ArgumentInjectionQuery.qll‎

Lines changed: 0 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -2,7 +2,6 @@ private import actions
22
private import codeql.actions.TaintTracking
33
private import codeql.actions.dataflow.ExternalFlow
44
import codeql.actions.dataflow.FlowSources
5-
import codeql.actions.dataflow.FlowSteps
65
import codeql.actions.DataFlow
76

87
abstract class ArgumentInjectionSink extends DataFlow::Node {

‎ql/lib/codeql/actions/security/ArtifactPoisoningQuery.qll‎

Lines changed: 0 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,6 @@
11
import actions
22
private import codeql.actions.TaintTracking
33
import codeql.actions.DataFlow
4-
private import codeql.actions.dataflow.ExternalFlow
54
import codeql.actions.dataflow.FlowSources
65
import codeql.actions.security.PoisonableSteps
76

‎ql/lib/codeql/actions/security/CachePoisoningQuery.qll‎

Lines changed: 0 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,4 @@
11
import actions
2-
import codeql.actions.config.Config
3-
import codeql.actions.Helper
42

53
string defaultBranchTriggerEvent() {
64
result =

‎ql/lib/codeql/actions/security/ControlChecks.qll‎

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -253,6 +253,9 @@ class AssociationActionCheck extends AssociationCheck instanceof UsesStep {
253253
or
254254
this.getArgument("exit") = "true"
255255
)
256+
or
257+
this.getCallee() = "actions/github-script" and
258+
this.getArgument("script").splitAt("\n").matches("%getMembershipForUserInOrg%")
256259
}
257260
}
258261

‎ql/lib/codeql/actions/security/EnvPathInjectionQuery.qll‎

Lines changed: 10 additions & 13 deletions
Original file line numberDiff line numberDiff line change
@@ -3,20 +3,11 @@ private import codeql.actions.TaintTracking
33
private import codeql.actions.dataflow.ExternalFlow
44
private import codeql.actions.security.ArtifactPoisoningQuery
55
private import codeql.actions.security.UntrustedCheckoutQuery
6-
private import codeql.actions.dataflow.FlowSteps
7-
import codeql.actions.DataFlow
8-
import codeql.actions.dataflow.FlowSources
96

107
abstract class EnvPathInjectionSink extends DataFlow::Node { }
118

129
/**
1310
* Holds if a Run step declares a PATH environment variable with contents from a local file.
14-
* e.g.
15-
* run: |
16-
* cat foo.txt >> $GITHUB_PATH
17-
* echo "$(cat foo.txt)" >> $GITHUB_PATH
18-
* FOO=$(cat foo.txt)
19-
* echo "$FOO" >> $GITHUB_PATH
2011
*/
2112
class EnvPathInjectionFromFileReadSink extends EnvPathInjectionSink {
2213
EnvPathInjectionFromFileReadSink() {
@@ -28,11 +19,15 @@ class EnvPathInjectionFromFileReadSink extends EnvPathInjectionSink {
2819
this.asExpr() = run.getScript() and
2920
step.getAFollowingStep() = run and
3021
(
22+
// echo "$(cat foo.txt)" >> $GITHUB_PATH
23+
// FOO=$(cat foo.txt)
24+
// echo "$FOO" >> $GITHUB_PATH
3125
exists(string cmd |
32-
run.getScript().getACmdReachingGitHubPathWrite(cmd) and
33-
run.getScript().getAFileReadCommand() = cmd
26+
run.getScript().getAFileReadCommand() = cmd and
27+
run.getScript().getACmdReachingGitHubPathWrite(cmd)
3428
)
3529
or
30+
// cat foo.txt >> $GITHUB_PATH
3631
run.getScript().fileToGitHubPath(_)
3732
)
3833
)
@@ -91,8 +86,10 @@ private module EnvPathInjectionConfig implements DataFlow::ConfigSig {
9186
run.getInScopeEnvVarExpr(var) = pred.asExpr() and
9287
succ.asExpr() = run.getScript() and
9388
(
94-
run.getScript().getAnEnvReachingGitHubOutputWrite(var, _) or
95-
run.getScript().getAnEnvReachingGitHubEnvWrite(var, _) or
89+
run.getScript().getAnEnvReachingGitHubEnvWrite(var, _)
90+
or
91+
run.getScript().getAnEnvReachingGitHubOutputWrite(var, _)
92+
or
9693
run.getScript().getAnEnvReachingGitHubPathWrite(var)
9794
)
9895
)

‎ql/lib/codeql/actions/security/EnvVarInjectionQuery.qll‎

Lines changed: 0 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -3,9 +3,6 @@ private import codeql.actions.TaintTracking
33
private import codeql.actions.dataflow.ExternalFlow
44
private import codeql.actions.security.ArtifactPoisoningQuery
55
private import codeql.actions.security.UntrustedCheckoutQuery
6-
private import codeql.actions.dataflow.FlowSteps
7-
import codeql.actions.DataFlow
8-
import codeql.actions.dataflow.FlowSources
96

107
abstract class EnvVarInjectionSink extends DataFlow::Node { }
118

‎ql/lib/codeql/actions/security/OutputClobberingQuery.qll‎

Lines changed: 0 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -3,9 +3,6 @@ private import codeql.actions.TaintTracking
33
private import codeql.actions.dataflow.ExternalFlow
44
private import codeql.actions.security.ArtifactPoisoningQuery
55
private import codeql.actions.security.UntrustedCheckoutQuery
6-
private import codeql.actions.dataflow.FlowSteps
7-
import codeql.actions.DataFlow
8-
import codeql.actions.dataflow.FlowSources
96

107
abstract class OutputClobberingSink extends DataFlow::Node { }
118

‎ql/lib/codeql/actions/security/PoisonableSteps.qll‎

Lines changed: 0 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,4 @@
11
import actions
2-
import codeql.actions.config.Config
32

43
abstract class PoisonableStep extends Step { }
54

‎ql/lib/codeql/actions/security/SecretExfiltrationQuery.qll‎

Lines changed: 0 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -2,7 +2,6 @@ private import actions
22
private import codeql.actions.TaintTracking
33
private import codeql.actions.dataflow.ExternalFlow
44
import codeql.actions.dataflow.FlowSources
5-
private import codeql.actions.security.ArtifactPoisoningQuery
65
import codeql.actions.DataFlow
76

87
private class SecretExfiltrationSink extends DataFlow::Node {

‎ql/lib/codeql/actions/security/SelfHostedQuery.qll‎

Lines changed: 0 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,4 @@
11
import actions
2-
import codeql.actions.config.Config
32

43
bindingset[runner]
54
predicate isGithubHostedRunner(string runner) {

0 commit comments

Comments
 (0)