Skip to content

Commit 4ad7c1f

Browse files
author
Alvaro Muñoz
authored
Merge pull request #57 from github/workflow_run_branches
workflow run branches
2 parents 8231261 + 621ead2 commit 4ad7c1f

File tree

17 files changed

+186
-13
lines changed

17 files changed

+186
-13
lines changed

‎ql/lib/codeql/actions/Helper.qll‎

Lines changed: 8 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,6 @@
11
private import codeql.actions.Ast
22
private import codeql.Locations
3+
import codeql.actions.config.Config
34
private import codeql.actions.security.ControlChecks
45

56
bindingset[expr]
@@ -264,3 +265,10 @@ predicate outputsPartialFileContent(string snippet) {
264265
".*"
265266
])
266267
}
268+
269+
string defaultBranchNames() {
270+
repositoryDataModel(_, result)
271+
or
272+
not exists(string default_branch_name | repositoryDataModel(_, default_branch_name)) and
273+
result = ["main", "master"]
274+
}

‎ql/lib/codeql/actions/ast/internal/Ast.qll‎

Lines changed: 12 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -710,7 +710,18 @@ class EventImpl extends AstNodeImpl, TEventNode {
710710
/** Holds if the event can be triggered by an external actor. */
711711
predicate isExternallyTriggerable() {
712712
// the job is triggered by an event that can be triggered externally
713-
externallyTriggerableEventsDataModel(this.getName())
713+
// except for workflow_run which requires additional checks
714+
externallyTriggerableEventsDataModel(this.getName()) and
715+
not this.getName() = "workflow_run"
716+
or
717+
this.getName() = "workflow_run" and
718+
// workflow_run cannot be externally triggered if they triggering workflow runs in the context of the default branch
719+
// since an attacker can change the triggering workflow from any event to `pull_request` to trigger the workflow
720+
// but in that case, the triggering workflow will run in the context of the PR head branch
721+
(
722+
not exists(this.getAPropertyValue("branches")) or
723+
this.getAPropertyValue("branches").matches("%*%")
724+
)
714725
or
715726
// the event is `workflow_call` and there is a caller workflow that can be triggered externally
716727
this.getName() = "workflow_call" and

‎ql/lib/codeql/actions/security/CachePoisoningQuery.qll‎

Lines changed: 1 addition & 10 deletions
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,6 @@
11
import actions
22
import codeql.actions.config.Config
3+
import codeql.actions.Helper
34

45
string defaultBranchTriggerEvent() {
56
result =
@@ -11,16 +12,6 @@ string defaultBranchTriggerEvent() {
1112
]
1213
}
1314

14-
string defaultBranchNames() {
15-
exists(string default_branch_name |
16-
repositoryDataModel(_, default_branch_name) and
17-
result = default_branch_name
18-
)
19-
or
20-
not exists(string default_branch_name | repositoryDataModel(_, default_branch_name)) and
21-
result = ["main", "master"]
22-
}
23-
2415
predicate runsOnDefaultBranch(Event e) {
2516
(
2617
e.getName() = defaultBranchTriggerEvent() and

‎ql/lib/ext/manual/appleboy_ssh-action.model.yml‎

Lines changed: 8 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,8 @@
1+
extensions:
2+
- addsTo:
3+
pack: github/actions-all
4+
extensible: actionsSinkModel
5+
data:
6+
- ["appleboy/ssh-action", "*", "input.script", "code-injection", "manual"]
7+
- ["appleboy/ssh-action", "*", "input.envs", "envvar-injection", "manual"]
8+

‎ql/lib/qlpack.yml‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -2,7 +2,7 @@
22
library: true
33
warnOnImplicitThis: true
44
name: github/actions-all
5-
version: 0.1.15
5+
version: 0.1.16
66
dependencies:
77
codeql/util: ^1.0.1
88
codeql/yaml: ^1.0.1

‎ql/src/qlpack.yml‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,7 @@
11
---
22
library: false
33
name: github/actions-queries
4-
version: 0.1.15
4+
version: 0.1.16
55
groups: [actions, queries]
66
suites: codeql-suites
77
extractor: javascript

‎ql/test/query-tests/Security/CWE-094/.github/workflows/workflow_run_branches1.yml‎

Lines changed: 13 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,13 @@
1+
name: Self-hosted runner (AMD mi250 CI caller)
2+
3+
on:
4+
workflow_run:
5+
workflows: ["Test"]
6+
branches: ["main"]
7+
types: [completed]
8+
9+
jobs:
10+
test:
11+
runs-on: ubuntu-latest
12+
steps:
13+
- run: echo ${{ github.event.workflow_run.head_branch }}

‎ql/test/query-tests/Security/CWE-094/.github/workflows/workflow_run_branches2.yml‎

Lines changed: 13 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,13 @@
1+
name: Self-hosted runner (AMD mi250 CI caller)
2+
3+
on:
4+
workflow_run:
5+
workflows: ["Test"]
6+
branches: "main"
7+
types: [completed]
8+
9+
jobs:
10+
test:
11+
runs-on: ubuntu-latest
12+
steps:
13+
- run: echo ${{ github.event.workflow_run.head_branch }}

‎ql/test/query-tests/Security/CWE-094/.github/workflows/workflow_run_branches3.yml‎

Lines changed: 12 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,12 @@
1+
name: Self-hosted runner (AMD mi250 CI caller)
2+
3+
on:
4+
workflow_run:
5+
workflows: ["Test"]
6+
types: [completed]
7+
8+
jobs:
9+
test:
10+
runs-on: ubuntu-latest
11+
steps:
12+
- run: echo ${{ github.event.workflow_run.head_branch }}

‎ql/test/query-tests/Security/CWE-094/.github/workflows/workflow_run_branches4.yml‎

Lines changed: 13 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,13 @@
1+
name: Self-hosted runner (AMD mi250 CI caller)
2+
3+
on:
4+
workflow_run:
5+
workflows: ["Test"]
6+
branches: ["feat/**"]
7+
types: [completed]
8+
9+
jobs:
10+
test:
11+
runs-on: ubuntu-latest
12+
steps:
13+
- run: echo ${{ github.event.workflow_run.head_branch }}

0 commit comments

Comments
 (0)