Skip to content

Commit c9b1cd2

Browse files
KyFaStKyFaSt
committed
add workflow to catch some ineligible wildcards and eligible latest version for immutable actions
1 parent 023e8cb commit c9b1cd2

3 files changed

Lines changed: 53 additions & 3 deletions

File tree

‎ql/lib/codeql/actions/security/UseOfUnversionedImmutableAction.qll‎

Lines changed: 12 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -6,11 +6,20 @@ class UnversionedImmutableAction extends UsesStep {
66
UnversionedImmutableAction() {
77
immutableActionsDataModel(immutable_action) and
88
this.getCallee() = immutable_action and
9-
isNotSemVer(this.getVersion())
9+
not isSemVer(this.getVersion())
1010
}
1111
}
1212

1313
bindingset[version]
14-
predicate isNotSemVer(string version) {
15-
not version.regexpMatch("^(v)?[0-9]+(\\.[0-9]+)*(\\.[xX])?$")
14+
predicate isSemVer(string version) {
15+
// https://semver.org/#is-there-a-suggested-regular-expression-regex-to-check-a-semver-string with optional v prefix
16+
version.regexpMatch("^v?(0|[1-9]\\d*)\\.(0|[1-9]\\d*)\\.(0|[1-9]\\d*)(?:-((?:0|[1-9]\\d*|\\d*[a-zA-Z-][0-9a-zA-Z-]*)(?:\\.(?:0|[1-9]\\d*|\\d*[a-zA-Z-][0-9a-zA-Z-]*))*))?(?:\\+([0-9a-zA-Z-]+(?:\\.[0-9a-zA-Z-]+)*))?$")
17+
18+
// or N or N.x or N.N.x with optional v prefix
19+
or version.regexpMatch("^v?[1-9]\\d*$")
20+
or version.regexpMatch("^v?[1-9]\\d*\\.(x|0|([1-9]\\d*))$")
21+
or version.regexpMatch("^v?[1-9]\\d*\\.(0|([1-9]\\d*))\\.(x|0|([1-9]\\d*))$")
22+
23+
// or latest which will work
24+
or version = "latest"
1625
}

‎ql/test/query-tests/Security/CWE-829/.github/workflows/issue_comment_octokit2.yml‎

Lines changed: 38 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,38 @@
1+
name: Octokit (heuristics)
2+
3+
on:
4+
issue_comment:
5+
types: [created]
6+
7+
jobs:
8+
test1:
9+
if: github.event.comment.body == '@metabase-bot run visual tests'
10+
runs-on: ubuntu-22.04
11+
steps:
12+
- name: Fetch issue
13+
uses: octokit/request-action@v2.x
14+
id: fetch_issue
15+
with:
16+
route: GET ${{ github.event.issue.url }}
17+
env:
18+
GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
19+
- name: Fetch PR minor and patch wildcard
20+
uses: octokit/request-action@v2.x.x
21+
id: fetch_pr
22+
with:
23+
route: GET ${{ fromJson(steps.fetch_issue.outputs.data).pull_request.url }}
24+
env:
25+
GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
26+
- name: Checkout PR minor patch wildcard
27+
- uses: actions/checkout@v2.x.xx
28+
with:
29+
ref: ${{ fromJson(steps.fetch_pr.outputs.data).head.ref }}
30+
token: ${{ secrets.GITHUB_TOKEN }}
31+
- name: Checkout PR minor wildcard incomplete patch
32+
uses: actions/checkout@v2.x.
33+
- name: Run latest action
34+
uses: some-action/some-repo@latest
35+
with:
36+
some-input: some-value
37+
- name: run the latest checkout action
38+
uses: actions/checkout@latest

‎ql/test/query-tests/Security/CWE-829/UnversionedImmutableAction.expected‎

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -4,6 +4,9 @@
44
| .github/workflows/artifactpoisoning91.yml:25:9:28:6 | Uses Step | The workflow is using an immutable action ($@) without versinoning so it doesn't work | .github/workflows/artifactpoisoning91.yml:25:9:28:6 | Uses Step | actions/checkout |
55
| .github/workflows/artifactpoisoning92.yml:17:9:18:6 | Uses Step | The workflow is using an immutable action ($@) without versinoning so it doesn't work | .github/workflows/artifactpoisoning92.yml:17:9:18:6 | Uses Step | actions/checkout |
66
| .github/workflows/artifactpoisoning92.yml:25:9:28:6 | Uses Step | The workflow is using an immutable action ($@) without versinoning so it doesn't work | .github/workflows/artifactpoisoning92.yml:25:9:28:6 | Uses Step | actions/checkout |
7+
| .github/workflows/issue_comment_octokit2.yml:19:9:26:6 | Uses Step: fetch_pr | The workflow is using an immutable action ($@) without versinoning so it doesn't work | .github/workflows/issue_comment_octokit2.yml:19:9:26:6 | Uses Step: fetch_pr | octokit/request-action |
8+
| .github/workflows/issue_comment_octokit2.yml:27:9:31:6 | Uses Step | The workflow is using an immutable action ($@) without versinoning so it doesn't work | .github/workflows/issue_comment_octokit2.yml:27:9:31:6 | Uses Step | actions/checkout |
9+
| .github/workflows/issue_comment_octokit2.yml:31:9:33:6 | Uses Step | The workflow is using an immutable action ($@) without versinoning so it doesn't work | .github/workflows/issue_comment_octokit2.yml:31:9:33:6 | Uses Step | actions/checkout |
710
| .github/workflows/poc.yml:30:9:36:6 | Uses Step | The workflow is using an immutable action ($@) without versinoning so it doesn't work | .github/workflows/poc.yml:30:9:36:6 | Uses Step | actions/checkout |
811
| .github/workflows/poc.yml:36:9:38:6 | Uses Step | The workflow is using an immutable action ($@) without versinoning so it doesn't work | .github/workflows/poc.yml:36:9:38:6 | Uses Step | actions/configure-pages |
912
| .github/workflows/poc.yml:43:9:47:2 | Uses Step | The workflow is using an immutable action ($@) without versinoning so it doesn't work | .github/workflows/poc.yml:43:9:47:2 | Uses Step | actions/upload-pages-artifact |

0 commit comments

Comments
 (0)