Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Actions: Sequester issue_comment triggered untrusted checkout from other triggers #18838

Open
wants to merge 10 commits into
base: main
Choose a base branch
from
Prev Previous commit
Next Next commit
autoformat untrusted checkout query qll
  • Loading branch information
KyFaSt committed Feb 25, 2025
commit 8ab3ce0fb87f11e4092a8db39d8c745ade6cf130
Original file line number Diff line number Diff line change
@@ -3,13 +3,9 @@ private import codeql.actions.DataFlow
private import codeql.actions.dataflow.FlowSources
private import codeql.actions.TaintTracking

string checkoutTriggers() {
result = ["pull_request_target", "workflow_run", "workflow_call"]
}
string checkoutTriggers() { result = ["pull_request_target", "workflow_run", "workflow_call"] }

string issueCommentTriggers() {
result = ["issue_comment"]
}
string issueCommentTriggers() { result = ["issue_comment"] }

Check warning

Code scanning / CodeQL

Singleton set literal Warning

Singleton set literal can be replaced by its member.

string allCheckoutTriggers() {
result = ["pull_request_target", "workflow_run", "workflow_call", "issue_comment"]
@@ -84,8 +80,7 @@ module ActionsMutableRefCheckoutFlow = TaintTracking::Global<ActionsMutableRefCh

private module ActionsSHACheckoutConfig implements DataFlow::ConfigSig {
predicate isSource(DataFlow::Node source) {
source.asExpr().getATriggerEvent().getName() =
allCheckoutTriggers() and
source.asExpr().getATriggerEvent().getName() = allCheckoutTriggers() and
(
// `ref` argument contains the PR head/merge commit sha
exists(Expression e |