Create getATriggerEvent for Steps and refactor the code to use it

Author: Alvaro Muñoz

ql/lib/codeql/actions/Ast.qll

@@ -17,6 +17,8 @@ class AstNode instanceof AstNodeImpl {
 
   Job getEnclosingJob() { result = super.getEnclosingJob() }
 
+  Event getATriggerEvent() { result = super.getATriggerEvent() }
+
   Workflow getEnclosingWorkflow() { result = super.getEnclosingWorkflow() }
 
   CompositeAction getEnclosingCompositeAction() { result = super.getEnclosingCompositeAction() }
@@ -100,8 +102,6 @@ class Workflow extends AstNode instanceof WorkflowImpl {
 
   Job getJob(string jobId) { result = super.getJob(jobId) }
 
-  Event getATriggerEvent() { result = super.getATriggerEvent() }
-
   Permissions getPermissions() { result = super.getPermissions() }
 
   Strategy getStrategy() { result = super.getStrategy() }
@@ -200,8 +200,6 @@ abstract class Job extends AstNode instanceof JobImpl {
 
   Permissions getPermissions() { result = super.getPermissions() }
 
-  Event getATriggerEvent() { result = super.getATriggerEvent() }
-
   Strategy getStrategy() { result = super.getStrategy() }
 
   string getARunsOnLabel() { result = super.getARunsOnLabel() }

ql/lib/codeql/actions/ast/internal/Ast.qll

@@ -111,6 +111,11 @@ abstract class AstNodeImpl extends TAstNode {
     result = this.getEnclosingCompositeAction().getACallerJob()
   }
 
+  /**
+   * Gets and Event triggering this node.
+   */
+  EventImpl getATriggerEvent() { result = this.getEnclosingJob().getATriggerEvent() }
+
   /**
    * Gets the enclosing Step.
    */
@@ -447,7 +452,7 @@ class CompositeActionImpl extends AstNodeImpl, TCompositeAction {
     )
   }
 
-  EventImpl getATriggerEvent() { result = this.getACallerJob().getATriggerEvent() }
+  override EventImpl getATriggerEvent() { result = this.getACallerJob().getATriggerEvent() }
 }
 
 class WorkflowImpl extends AstNodeImpl, TWorkflowNode {
@@ -486,7 +491,7 @@ class WorkflowImpl extends AstNodeImpl, TWorkflowNode {
   PermissionsImpl getPermissions() { result.getNode() = n.lookup("permissions") }
 
   /** Gets the trigger event that starts this workflow. */
-  EventImpl getATriggerEvent() { this.getOn().getAnEvent() = result }
+  override EventImpl getATriggerEvent() { this.getOn().getAnEvent() = result }
 
   /** Gets the strategy for this workflow. */
   StrategyImpl getStrategy() { result.getNode() = n.lookup("strategy") }
@@ -918,7 +923,7 @@ class JobImpl extends AstNodeImpl, TJobNode {
   StrategyImpl getStrategy() { result.getNode() = n.lookup("strategy") }
 
   /** Gets the trigger event that starts this workflow. */
-  EventImpl getATriggerEvent() {
+  override EventImpl getATriggerEvent() {
     if this.getEnclosingWorkflow() instanceof ReusableWorkflowImpl
     then
       result = this.getEnclosingWorkflow().(ReusableWorkflowImpl).getACaller().getATriggerEvent()
@@ -1174,6 +1179,8 @@ class StepImpl extends AstNodeImpl, TStepNode {
     result = super.getEnclosingJob()
   }
 
+  override EventImpl getATriggerEvent() { result = this.getEnclosingJob().getATriggerEvent() }
+
   EnvImpl getEnv() { result.getNode() = n.lookup("env") }
 
   /** Gets the ID of this step, if any. */

ql/lib/codeql/actions/dataflow/FlowSources.qll

@@ -91,7 +91,7 @@ class GitCommandSource extends RemoteFlowSource, CommandSource {
           uses.getCallee() = "actions/checkout" and
           exists(uses.getArgument("ref")) and
           not uses.getArgument("ref").matches("%base%") and
-          uses.getEnclosingJob().getATriggerEvent().getName() = checkoutTriggers()
+          uses.getATriggerEvent().getName() = checkoutTriggers()
         )
         or
         checkout instanceof GitMutableRefCheckout
@@ -239,7 +239,7 @@ private class CheckoutSource extends RemoteFlowSource, FileSource {
       uses.getCallee() = "actions/checkout" and
       exists(uses.getArgument("ref")) and
       not uses.getArgument("ref").matches("%base%") and
-      uses.getEnclosingJob().getATriggerEvent().getName() = checkoutTriggers()
+      uses.getATriggerEvent().getName() = checkoutTriggers()
     )
     or
     this.asExpr() instanceof GitMutableRefCheckout

ql/lib/codeql/actions/security/ControlChecks.qll

@@ -57,7 +57,7 @@ abstract class ControlCheck extends AstNode {
     // The check is effective against the event and category
     this.protectsCategoryAndEvent(category, event.getName()) and
     // The check can be triggered by the event
-    this.getEnclosingJob().getATriggerEvent() = event
+    this.getATriggerEvent() = event
   }
 
   predicate dominates(AstNode node) {

ql/lib/codeql/actions/security/OutputClobberingQuery.qll

@@ -30,7 +30,7 @@ class OutputClobberingFromFileReadSink extends OutputClobberingSink {
           uses.getCallee() = "actions/checkout" and
           exists(uses.getArgument("ref")) and
           not uses.getArgument("ref").matches("%base%") and
-          uses.getEnclosingJob().getATriggerEvent().getName() = checkoutTriggers()
+          uses.getATriggerEvent().getName() = checkoutTriggers()
         )
         or
         step instanceof GitMutableRefCheckout

ql/lib/codeql/actions/security/UntrustedCheckoutQuery.qll

@@ -13,7 +13,7 @@ string checkoutTriggers() {
  */
 private module ActionsMutableRefCheckoutConfig implements DataFlow::ConfigSig {
   predicate isSource(DataFlow::Node source) {
-    source.asExpr().getEnclosingJob().getATriggerEvent().getName() = checkoutTriggers() and
+    source.asExpr().getATriggerEvent().getName() = checkoutTriggers() and
     (
       // remote flow sources
       source instanceof ArtifactSource
@@ -79,7 +79,7 @@ module ActionsMutableRefCheckoutFlow = TaintTracking::Global<ActionsMutableRefCh
 
 private module ActionsSHACheckoutConfig implements DataFlow::ConfigSig {
   predicate isSource(DataFlow::Node source) {
-    source.asExpr().getEnclosingJob().getATriggerEvent().getName() =
+    source.asExpr().getATriggerEvent().getName() =
       ["pull_request_target", "workflow_run", "workflow_call", "issue_comment"] and
     (
       // `ref` argument contains the PR head/merge commit sha
@@ -283,7 +283,7 @@ class ActionsSHACheckout extends SHACheckoutStep instanceof UsesStep {
 class GitMutableRefCheckout extends MutableRefCheckoutStep instanceof Run {
   GitMutableRefCheckout() {
     exists(string cmd | this.getScript().getACommand() = cmd |
-      this.getEnclosingJob().getATriggerEvent().getName() = checkoutTriggers() and
+      this.getATriggerEvent().getName() = checkoutTriggers() and
       cmd.regexpMatch("git\\s+(fetch|pull).*") and
       (
         (containsHeadRef(cmd) or containsPullRequestNumber(cmd))
@@ -307,7 +307,7 @@ class GitMutableRefCheckout extends MutableRefCheckoutStep instanceof Run {
 class GitSHACheckout extends SHACheckoutStep instanceof Run {
   GitSHACheckout() {
     exists(string cmd | this.getScript().getACommand() = cmd |
-      this.getEnclosingJob().getATriggerEvent().getName() = checkoutTriggers() and
+      this.getATriggerEvent().getName() = checkoutTriggers() and
       cmd.regexpMatch("git\\s+(fetch|pull).*") and
       (
         containsHeadSHA(cmd)
@@ -328,7 +328,7 @@ class GitSHACheckout extends SHACheckoutStep instanceof Run {
 class GhMutableRefCheckout extends MutableRefCheckoutStep instanceof Run {
   GhMutableRefCheckout() {
     exists(string cmd | this.getScript().getACommand() = cmd |
-      this.getEnclosingJob().getATriggerEvent().getName() = checkoutTriggers() and
+      this.getATriggerEvent().getName() = checkoutTriggers() and
       cmd.regexpMatch(".*(gh|hub)\\s+pr\\s+checkout.*") and
       (
         (containsHeadRef(cmd) or containsPullRequestNumber(cmd))
@@ -351,7 +351,7 @@ class GhMutableRefCheckout extends MutableRefCheckoutStep instanceof Run {
 class GhSHACheckout extends SHACheckoutStep instanceof Run {
   GhSHACheckout() {
     exists(string cmd | this.getScript().getACommand() = cmd |
-      this.getEnclosingJob().getATriggerEvent().getName() = checkoutTriggers() and
+      this.getATriggerEvent().getName() = checkoutTriggers() and
       cmd.regexpMatch("gh\\s+pr\\s+checkout.*") and
       (
         containsHeadSHA(cmd)

ql/src/Security/CWE-829/ArtifactPoisoningPathTraversal.ql

@@ -18,7 +18,7 @@ import codeql.actions.security.UseOfKnownVulnerableActionQuery
 
 from UsesStep download, KnownVulnerableAction vulnerable_action, Event event
 where
-  event = download.getEnclosingJob().getATriggerEvent() and
+  event = download.getATriggerEvent() and
   vulnerable_action.getVulnerableAction() = download.getCallee() and
   download.getCallee() = "actions/download-artifact" and
   (