Skip to content

feat: add CodeQL injection sink data - #849

Merged
woodruffw merged 7 commits into
mainfrom
ww/codeql-injection-sinks
May 25, 2025
Merged

feat: add CodeQL injection sink data#849
woodruffw merged 7 commits into
mainfrom
ww/codeql-injection-sinks

Conversation

@woodruffw

@woodruffw woodruffw commented May 23, 2025

Copy link
Copy Markdown
Member

Closes #743.

Closes #417.

TODOs:

  • Finish integrating
  • Add tests
  • Credit @Marcono1234 in the commit + release notes (since this is heavily adapted from their PR).

@woodruffw woodruffw self-assigned this May 23, 2025
@woodruffw woodruffw added the enhancement New feature or request label May 23, 2025
@woodruffw
woodruffw force-pushed the ww/codeql-injection-sinks branch from 8994407 to 64723ce Compare May 23, 2025 21:11
Co-authored-by: Marcono1234 <Marcono1234@users.noreply.github.com>
Signed-off-by: William Woodruff <william@yossarian.net>
@woodruffw
woodruffw force-pushed the ww/codeql-injection-sinks branch from 64723ce to af2236f Compare May 23, 2025 21:15
@woodruffw
woodruffw marked this pull request as ready for review May 23, 2025 21:35

@Marcono1234 Marcono1234 left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Thanks a lot for taking this over! And sorry that I had not updated my PR yet. I had started making some modifications locally (nothing big), but did not get around to finishing it.

I have added some comments here, hopefully they are useful, but feel free to consider them at most suggestions.

Comment thread crates/zizmor/src/audit/template_injection.rs
Comment thread support/codeql-injection-sinks.py
Comment thread support/codeql-injection-sinks.py Outdated
Comment thread support/codeql-injection-sinks.py Outdated
Comment thread Makefile
woodruffw and others added 6 commits May 25, 2025 11:48
Co-authored-by: Marcono1234 <Marcono1234@users.noreply.github.com>
Also remove a duplicated path construction.

Signed-off-by: William Woodruff <william@yossarian.net>
Signed-off-by: William Woodruff <william@yossarian.net>
Signed-off-by: William Woodruff <william@yossarian.net>
Signed-off-by: William Woodruff <william@yossarian.net>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

enhancement New feature or request

Projects

None yet

Development

Successfully merging this pull request may close these issues.

template-injection: investigate other sinks

2 participants