Skip to content

Commit ff17d1d

Browse files
author
Alvaro Muñoz
committed
Add CmdI test
1 parent 3b95ae0 commit ff17d1d

4 files changed

Lines changed: 284 additions & 1 deletion

File tree

ql/src/Debug/partial.ql

Lines changed: 3 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -18,7 +18,9 @@ import PartialFlow::PartialPathGraph
1818
private module MyConfig implements DataFlow::ConfigSig {
1919
predicate isSource(DataFlow::Node source) {
2020
source instanceof RemoteFlowSource and
21-
source.getLocation().getFile().getBaseName() = "non-existant-test.yml"
21+
//source.getLocation().getFile().getBaseName() = "non-existant-test.yml"
22+
source.getLocation().getFile().getBaseName() = "test16.yml" and
23+
source.getLocation().getStartLine() = 125
2224
}
2325

2426
predicate isSink(DataFlow::Node sink) { none() }
Lines changed: 231 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,231 @@
1+
name: 📤 Preview Deploy
2+
3+
on:
4+
workflow_run:
5+
workflows:
6+
- 🎬 Setup
7+
types:
8+
- completed
9+
10+
permissions:
11+
contents: read
12+
pull-requests: write
13+
14+
jobs:
15+
setup:
16+
if: ${{ github.event.workflow_run.conclusion == 'success' }}
17+
runs-on: ubuntu-latest
18+
19+
outputs:
20+
id: ${{ steps.pr.outputs.value }}
21+
ref: ${{ steps.ref.outputs.value }}
22+
repo: ${{ steps.repo.outputs.value }}
23+
24+
steps:
25+
# Get PR id from artifact
26+
- name: download pr artifact
27+
uses: dawidd6/action-download-artifact@v2
28+
with:
29+
workflow: ${{ github.event.workflow_run.workflow_id }}
30+
run_id: ${{ github.event.workflow_run.id }}
31+
name: pr-id
32+
33+
- name: get PR id
34+
id: pr
35+
run: echo "value=$(<pr-id.txt)" >> $GITHUB_OUTPUT
36+
37+
# Get PR ref from artifact
38+
- name: download pr artifact
39+
uses: dawidd6/action-download-artifact@v2
40+
with:
41+
workflow: ${{ github.event.workflow_run.workflow_id }}
42+
run_id: ${{ github.event.workflow_run.id }}
43+
name: pr-ref
44+
45+
- name: get PR ref
46+
id: ref
47+
run: echo "value=$(<pr-ref.txt)" >> $GITHUB_OUTPUT
48+
49+
# Get PR repo from artifact
50+
- name: download pr artifact
51+
uses: dawidd6/action-download-artifact@v2
52+
with:
53+
workflow: ${{ github.event.workflow_run.workflow_id }}
54+
run_id: ${{ github.event.workflow_run.id }}
55+
name: pr-repo
56+
57+
- name: get PR repo
58+
id: repo
59+
run: echo "value=$(<pr-repo.txt)" >> $GITHUB_OUTPUT
60+
61+
prepare:
62+
runs-on: ubuntu-latest
63+
needs: [setup]
64+
65+
steps:
66+
# ================= Create Comment =================
67+
- name: 🧽 Find And Delete Comment
68+
uses: peter-evans/find-comment@v2
69+
if: ${{ needs.setup.outputs.id != '' }}
70+
id: fc
71+
with:
72+
issue-number: ${{ needs.setup.outputs.id }}
73+
comment-author: 'github-actions[bot]'
74+
body-includes: View Deployment
75+
76+
- name: 📝 Create or update comment
77+
uses: peter-evans/create-or-update-comment@v3
78+
if: ${{ needs.setup.outputs.id != '' }}
79+
with:
80+
comment-id: ${{ steps.fc.outputs.comment-id }}
81+
issue-number: ${{ needs.setup.outputs.id }}
82+
body: |
83+
## View Deployment
84+
85+
[#${{ github.run_id }}](https://github.com/dream-num/univer/actions/runs/${{ github.run_id }})
86+
87+
<p align="center">
88+
🥐 🍔 🥓 🥗 🥘 🌯 🍚 🍛 🍖 🍭 🍧 🍝 🥪 🥖 🍪 <br />
89+
Still cooking, please come back later <br />
90+
🥙 🥮 🥨 🌭 🍦 🍙 🍕 🍰 🍮 🍜 🍡 🍱 🍿 🍕 🥟
91+
</p>
92+
edit-mode: replace
93+
94+
build-demo:
95+
runs-on: ubuntu-latest
96+
needs: [setup]
97+
98+
outputs:
99+
preview-url: ${{ steps.vercel-demo-dev.outputs.preview-url == '' && steps.vercel-demo.outputs.preview-url || steps.vercel-demo-dev.outputs.preview-url }}
100+
commit-message: ${{ steps.commit-message.outputs.value }}
101+
102+
steps:
103+
- name: Checkout
104+
uses: actions/checkout@v4
105+
with:
106+
repository: ${{ needs.setup.outputs.repo }}
107+
ref: ${{ needs.setup.outputs.ref }}
108+
109+
- name: Setup pnpm
110+
uses: pnpm/action-setup@v4
111+
with:
112+
run_install: false
113+
114+
- name: Setup Node.js
115+
uses: actions/setup-node@v4
116+
with:
117+
node-version: 20
118+
cache: pnpm
119+
120+
- name: Install dependencies
121+
run: pnpm install
122+
123+
- name: Get commit message
124+
id: commit-message
125+
run: echo "value=$(git log -1 --pretty=%s)" >> $GITHUB_OUTPUT
126+
127+
# ================= Deploy Demo =================
128+
- name: 📦 Build demo
129+
run: pnpm build:demo
130+
131+
- name: Copy demo to workspace
132+
run: |
133+
mkdir .workspace
134+
cp -r ./examples/local/* .workspace
135+
136+
- name: 🚀 Deploy to Vercel (demo)
137+
uses: amondnet/vercel-action@v25
138+
if: ${{ needs.setup.outputs.ref == '' }}
139+
id: vercel-demo
140+
with:
141+
vercel-token: ${{ secrets.VERCEL_TOKEN }}
142+
vercel-org-id: ${{ secrets.ORG_ID }}
143+
vercel-project-id: ${{ secrets.PROJECT_ID}}
144+
vercel-args: --prod
145+
146+
- name: 🚀 Deploy to Vercel (demo)
147+
uses: amondnet/vercel-action@v25
148+
if: ${{ needs.setup.outputs.ref != '' }}
149+
id: vercel-demo-dev
150+
with:
151+
vercel-token: ${{ secrets.VERCEL_TOKEN }}
152+
vercel-org-id: ${{ secrets.ORG_ID }}
153+
vercel-project-id: ${{ secrets.PROJECT_ID}}
154+
155+
build-storybook:
156+
runs-on: ubuntu-latest
157+
needs: [setup]
158+
159+
outputs:
160+
preview-url: ${{ steps.vercel-storybook-dev.outputs.preview-url == '' && steps.vercel-storybook.outputs.preview-url || steps.vercel-storybook-dev.outputs.preview-url }}
161+
162+
steps:
163+
- name: Checkout
164+
uses: actions/checkout@v4
165+
with:
166+
repository: ${{ needs.setup.outputs.repo }}
167+
ref: ${{ needs.setup.outputs.ref }}
168+
169+
- name: Setup pnpm
170+
uses: pnpm/action-setup@v4
171+
with:
172+
run_install: false
173+
174+
- name: Setup Node.js
175+
uses: actions/setup-node@v4
176+
with:
177+
node-version: 20
178+
cache: pnpm
179+
180+
- name: Install dependencies
181+
run: pnpm install
182+
183+
# ================= Deploy Storybook =================
184+
- name: 📦 Build storybook
185+
run: pnpm storybook:build
186+
187+
- name: 🚀 Deploy to Vercel (demo)
188+
uses: amondnet/vercel-action@v25
189+
if: ${{ needs.setup.outputs.ref == '' }}
190+
id: vercel-storybook
191+
with:
192+
vercel-token: ${{ secrets.VERCEL_TOKEN }}
193+
vercel-org-id: ${{ secrets.ORG_ID }}
194+
vercel-project-id: ${{ secrets.PROJECT_ID_STORYBOOK}}
195+
vercel-args: --prod
196+
197+
- name: 🚀 Deploy to Vercel (storybook)
198+
uses: amondnet/vercel-action@v25
199+
if: ${{ needs.setup.outputs.ref != '' }}
200+
id: vercel-storybook-dev
201+
with:
202+
vercel-token: ${{ secrets.VERCEL_TOKEN }}
203+
vercel-org-id: ${{ secrets.ORG_ID }}
204+
vercel-project-id: ${{ secrets.PROJECT_ID_STORYBOOK}}
205+
206+
notify:
207+
runs-on: ubuntu-latest
208+
needs: [setup, build-demo, build-storybook]
209+
210+
steps:
211+
- name: Invoke deployment hook
212+
uses: actions/github-script@v3
213+
with:
214+
script: >
215+
{
216+
"type": "build",
217+
"workflow": {
218+
"id": "${{ github.run_id }}"
219+
},
220+
"commit": {
221+
"ref": "${{ needs.setup.outputs.ref }}",
222+
"message": "${{ needs.build-demo.outputs.commit-message }}",
223+
"id": "${{ github.event.workflow_run.head_commit.id }}",
224+
"author": "${{ github.event.workflow_run.head_commit.author.name }}"
225+
},
226+
"preview": {
227+
"📑 Examples": "${{ needs.build-demo.outputs.preview-url }}/",
228+
"📚 Storybook": "${{ needs.build-storybook.outputs.preview-url }}/"
229+
}
230+
}
231+

ql/test/query-tests/Security/CWE-094/CodeInjectionCritical.expected

Lines changed: 27 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -145,6 +145,16 @@ edges
145145
| .github/workflows/test15.yml:26:14:27:100 | echo "TITLE=$(jq --raw-output .pull_request.title ${GITHUB_EVENT_PATH})" >> "$GITHUB_ENV"\n | .github/workflows/test15.yml:23:5:29:2 | Job: test3 [TITLE] | provenance | |
146146
| .github/workflows/test15.yml:30:5:36:37 | Job: test4 [TITLE] | .github/workflows/test15.yml:36:21:36:36 | env.TITLE | provenance | |
147147
| .github/workflows/test15.yml:33:14:35:50 | PR_TITLE=$(jq --raw-output .pull_request.title ${GITHUB_EVENT_PATH})\necho "TITLE=$PR_TITLE" >> "$GITHUB_ENV"\n | .github/workflows/test15.yml:30:5:36:37 | Job: test4 [TITLE] | provenance | |
148+
| .github/workflows/test16.yml:20:13:24:8 | Job outputs node [ref] | .github/workflows/test16.yml:215:19:230:24 | needs.setup.outputs.ref | provenance | |
149+
| .github/workflows/test16.yml:21:19:21:48 | steps.ref.outputs.value | .github/workflows/test16.yml:20:13:24:8 | Job outputs node [ref] | provenance | |
150+
| .github/workflows/test16.yml:26:15:33:12 | Uses Step | .github/workflows/test16.yml:47:20:47:64 | echo "value=$(<pr-ref.txt)" >> $GITHUB_OUTPUT | provenance | Config |
151+
| .github/workflows/test16.yml:38:15:45:12 | Uses Step | .github/workflows/test16.yml:47:20:47:64 | echo "value=$(<pr-ref.txt)" >> $GITHUB_OUTPUT | provenance | Config |
152+
| .github/workflows/test16.yml:45:15:50:12 | Run Step: ref [value] | .github/workflows/test16.yml:21:19:21:48 | steps.ref.outputs.value | provenance | |
153+
| .github/workflows/test16.yml:47:20:47:64 | echo "value=$(<pr-ref.txt)" >> $GITHUB_OUTPUT | .github/workflows/test16.yml:45:15:50:12 | Run Step: ref [value] | provenance | |
154+
| .github/workflows/test16.yml:99:13:102:8 | Job outputs node [commit-message] | .github/workflows/test16.yml:215:19:230:24 | needs.build-demo.outputs.commit-message | provenance | |
155+
| .github/workflows/test16.yml:100:30:100:70 | steps.commit-message.outputs.value | .github/workflows/test16.yml:99:13:102:8 | Job outputs node [commit-message] | provenance | |
156+
| .github/workflows/test16.yml:123:15:128:12 | Run Step: commit-message [value] | .github/workflows/test16.yml:100:30:100:70 | steps.commit-message.outputs.value | provenance | |
157+
| .github/workflows/test16.yml:125:20:125:75 | echo "value=$(git log -1 --pretty=%s)" >> $GITHUB_OUTPUT | .github/workflows/test16.yml:123:15:128:12 | Run Step: commit-message [value] | provenance | |
148158
| .github/workflows/test.yml:11:7:13:4 | Job outputs node [job_output] | .github/workflows/test.yml:52:20:52:56 | needs.job1.outputs['job_output'] | provenance | |
149159
| .github/workflows/test.yml:11:20:11:50 | steps.step5.outputs.MSG5 | .github/workflows/test.yml:11:7:13:4 | Job outputs node [job_output] | provenance | |
150160
| .github/workflows/test.yml:17:9:23:6 | Uses Step: step0 [value] | .github/workflows/test.yml:25:18:25:48 | steps.step0.outputs.value | provenance | |
@@ -449,6 +459,19 @@ nodes
449459
| .github/workflows/test15.yml:30:5:36:37 | Job: test4 [TITLE] | semmle.label | Job: test4 [TITLE] |
450460
| .github/workflows/test15.yml:33:14:35:50 | PR_TITLE=$(jq --raw-output .pull_request.title ${GITHUB_EVENT_PATH})\necho "TITLE=$PR_TITLE" >> "$GITHUB_ENV"\n | semmle.label | PR_TITLE=$(jq --raw-output .pull_request.title ${GITHUB_EVENT_PATH})\necho "TITLE=$PR_TITLE" >> "$GITHUB_ENV"\n |
451461
| .github/workflows/test15.yml:36:21:36:36 | env.TITLE | semmle.label | env.TITLE |
462+
| .github/workflows/test16.yml:20:13:24:8 | Job outputs node [ref] | semmle.label | Job outputs node [ref] |
463+
| .github/workflows/test16.yml:21:19:21:48 | steps.ref.outputs.value | semmle.label | steps.ref.outputs.value |
464+
| .github/workflows/test16.yml:26:15:33:12 | Uses Step | semmle.label | Uses Step |
465+
| .github/workflows/test16.yml:38:15:45:12 | Uses Step | semmle.label | Uses Step |
466+
| .github/workflows/test16.yml:45:15:50:12 | Run Step: ref [value] | semmle.label | Run Step: ref [value] |
467+
| .github/workflows/test16.yml:47:20:47:64 | echo "value=$(<pr-ref.txt)" >> $GITHUB_OUTPUT | semmle.label | echo "value=$(<pr-ref.txt)" >> $GITHUB_OUTPUT |
468+
| .github/workflows/test16.yml:99:13:102:8 | Job outputs node [commit-message] | semmle.label | Job outputs node [commit-message] |
469+
| .github/workflows/test16.yml:100:30:100:70 | steps.commit-message.outputs.value | semmle.label | steps.commit-message.outputs.value |
470+
| .github/workflows/test16.yml:123:15:128:12 | Run Step: commit-message [value] | semmle.label | Run Step: commit-message [value] |
471+
| .github/workflows/test16.yml:125:20:125:75 | echo "value=$(git log -1 --pretty=%s)" >> $GITHUB_OUTPUT | semmle.label | echo "value=$(git log -1 --pretty=%s)" >> $GITHUB_OUTPUT |
472+
| .github/workflows/test16.yml:215:19:230:24 | github.event.workflow_run.head_commit.author.name | semmle.label | github.event.workflow_run.head_commit.author.name |
473+
| .github/workflows/test16.yml:215:19:230:24 | needs.build-demo.outputs.commit-message | semmle.label | needs.build-demo.outputs.commit-message |
474+
| .github/workflows/test16.yml:215:19:230:24 | needs.setup.outputs.ref | semmle.label | needs.setup.outputs.ref |
452475
| .github/workflows/test.yml:11:7:13:4 | Job outputs node [job_output] | semmle.label | Job outputs node [job_output] |
453476
| .github/workflows/test.yml:11:20:11:50 | steps.step5.outputs.MSG5 | semmle.label | steps.step5.outputs.MSG5 |
454477
| .github/workflows/test.yml:17:9:23:6 | Uses Step: step0 [value] | semmle.label | Uses Step: step0 [value] |
@@ -596,6 +619,10 @@ subpaths
596619
| .github/workflows/test15.yml:21:21:21:52 | steps.title.outputs.title | .github/workflows/test15.yml:18:14:20:53 | PR_TITLE=$(jq --raw-output .pull_request.title ${GITHUB_EVENT_PATH})\necho "title=$PR_TITLE" >> "$GITHUB_OUTPUT"\n | .github/workflows/test15.yml:21:21:21:52 | steps.title.outputs.title | Potential code injection in $@, which may be controlled by an external user. | .github/workflows/test15.yml:21:21:21:52 | steps.title.outputs.title | ${{ steps.title.outputs.title }} |
597620
| .github/workflows/test15.yml:28:21:28:36 | env.TITLE | .github/workflows/test15.yml:26:14:27:100 | echo "TITLE=$(jq --raw-output .pull_request.title ${GITHUB_EVENT_PATH})" >> "$GITHUB_ENV"\n | .github/workflows/test15.yml:28:21:28:36 | env.TITLE | Potential code injection in $@, which may be controlled by an external user. | .github/workflows/test15.yml:28:21:28:36 | env.TITLE | ${{ env.TITLE }} |
598621
| .github/workflows/test15.yml:36:21:36:36 | env.TITLE | .github/workflows/test15.yml:33:14:35:50 | PR_TITLE=$(jq --raw-output .pull_request.title ${GITHUB_EVENT_PATH})\necho "TITLE=$PR_TITLE" >> "$GITHUB_ENV"\n | .github/workflows/test15.yml:36:21:36:36 | env.TITLE | Potential code injection in $@, which may be controlled by an external user. | .github/workflows/test15.yml:36:21:36:36 | env.TITLE | ${{ env.TITLE }} |
622+
| .github/workflows/test16.yml:215:19:230:24 | github.event.workflow_run.head_commit.author.name | .github/workflows/test16.yml:215:19:230:24 | github.event.workflow_run.head_commit.author.name | .github/workflows/test16.yml:215:19:230:24 | github.event.workflow_run.head_commit.author.name | Potential code injection in $@, which may be controlled by an external user. | .github/workflows/test16.yml:215:19:230:24 | github.event.workflow_run.head_commit.author.name | ${{ github.event.workflow_run.head_commit.author.name }} |
623+
| .github/workflows/test16.yml:215:19:230:24 | needs.build-demo.outputs.commit-message | .github/workflows/test16.yml:125:20:125:75 | echo "value=$(git log -1 --pretty=%s)" >> $GITHUB_OUTPUT | .github/workflows/test16.yml:215:19:230:24 | needs.build-demo.outputs.commit-message | Potential code injection in $@, which may be controlled by an external user. | .github/workflows/test16.yml:215:19:230:24 | needs.build-demo.outputs.commit-message | ${{ needs.build-demo.outputs.commit-message }} |
624+
| .github/workflows/test16.yml:215:19:230:24 | needs.setup.outputs.ref | .github/workflows/test16.yml:26:15:33:12 | Uses Step | .github/workflows/test16.yml:215:19:230:24 | needs.setup.outputs.ref | Potential code injection in $@, which may be controlled by an external user. | .github/workflows/test16.yml:215:19:230:24 | needs.setup.outputs.ref | ${{ needs.setup.outputs.ref }} |
625+
| .github/workflows/test16.yml:215:19:230:24 | needs.setup.outputs.ref | .github/workflows/test16.yml:38:15:45:12 | Uses Step | .github/workflows/test16.yml:215:19:230:24 | needs.setup.outputs.ref | Potential code injection in $@, which may be controlled by an external user. | .github/workflows/test16.yml:215:19:230:24 | needs.setup.outputs.ref | ${{ needs.setup.outputs.ref }} |
599626
| .github/workflows/test.yml:52:20:52:56 | needs.job1.outputs['job_output'] | .github/workflows/test.yml:20:20:20:62 | github.event['pull_request']['body'] | .github/workflows/test.yml:52:20:52:56 | needs.job1.outputs['job_output'] | Potential code injection in $@, which may be controlled by an external user. | .github/workflows/test.yml:52:20:52:56 | needs.job1.outputs['job_output'] | ${{needs.job1.outputs['job_output']}} |
600627
| .github/workflows/untrusted_checkout1.yml:15:20:15:58 | steps.artifact.outputs.pr_number | .github/workflows/untrusted_checkout1.yml:8:9:11:6 | Uses Step | .github/workflows/untrusted_checkout1.yml:15:20:15:58 | steps.artifact.outputs.pr_number | Potential code injection in $@, which may be controlled by an external user. | .github/workflows/untrusted_checkout1.yml:15:20:15:58 | steps.artifact.outputs.pr_number | ${{ steps.artifact.outputs.pr_number }} |
601628
| .github/workflows/workflow_run.yml:9:19:9:64 | github.event.workflow_run.display_title | .github/workflows/workflow_run.yml:9:19:9:64 | github.event.workflow_run.display_title | .github/workflows/workflow_run.yml:9:19:9:64 | github.event.workflow_run.display_title | Potential code injection in $@, which may be controlled by an external user. | .github/workflows/workflow_run.yml:9:19:9:64 | github.event.workflow_run.display_title | ${{ github.event.workflow_run.display_title }} |

0 commit comments

Comments
 (0)