Skip to content

Commit fd0aadf

Browse files
redsun82redsun82
authored
Merge branch 'main' into redsun82/cargo-upgrade
2 parents 9390fe2 + 02249af commit fd0aadf

File tree

231 files changed

+1591
-513
lines changed

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

231 files changed

+1591
-513
lines changed

‎actions/ql/lib/CHANGELOG.md‎

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1,3 +1,9 @@
1+
## 0.4.3
2+
3+
### New Features
4+
5+
* The "Unpinned tag for a non-immutable Action in workflow" query (`actions/unpinned-tag`) now supports expanding the trusted action owner list using data extensions (`extensible: trustedActionsOwnerDataModel`). If you trust an Action publisher, you can include the owner name/organization in a model pack to add it to the allow list for this query. This addition will prevent security alerts when using unpinned tags for Actions published by that owner. For more information on creating a model pack, see [Creating a CodeQL Model Pack](https://docs.github.com/en/code-security/codeql-cli/using-the-advanced-functionality-of-the-codeql-cli/creating-and-working-with-codeql-packs#creating-a-codeql-model-pack).
6+
17
## 0.4.2
28

39
### Bug Fixes

actions/ql/lib/change-notes/2025-01-07-trusted-owner-ext.md renamed to actions/ql/lib/change-notes/released/0.4.3.md

Lines changed: 5 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -1,4 +1,5 @@
1-
---
2-
category: feature
3-
---
4-
* The "Unpinned tag for a non-immutable Action in workflow" query (`actions/unpinned-tag`) now supports expanding the trusted action owner list using data extensions (`extensible: trustedActionsOwnerDataModel`). If you trust an Action publisher, you can include the owner name/organization in a model pack to add it to the allow list for this query. This addition will prevent security alerts when using unpinned tags for Actions published by that owner. For more information on creating a model pack, see [Creating a CodeQL Model Pack](https://docs.github.com/en/code-security/codeql-cli/using-the-advanced-functionality-of-the-codeql-cli/creating-and-working-with-codeql-packs#creating-a-codeql-model-pack).
1+
## 0.4.3
2+
3+
### New Features
4+
5+
* The "Unpinned tag for a non-immutable Action in workflow" query (`actions/unpinned-tag`) now supports expanding the trusted action owner list using data extensions (`extensible: trustedActionsOwnerDataModel`). If you trust an Action publisher, you can include the owner name/organization in a model pack to add it to the allow list for this query. This addition will prevent security alerts when using unpinned tags for Actions published by that owner. For more information on creating a model pack, see [Creating a CodeQL Model Pack](https://docs.github.com/en/code-security/codeql-cli/using-the-advanced-functionality-of-the-codeql-cli/creating-and-working-with-codeql-packs#creating-a-codeql-model-pack).

‎actions/ql/lib/codeql-pack.release.yml‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,2 +1,2 @@
11
---
2-
lastReleaseVersion: 0.4.2
2+
lastReleaseVersion: 0.4.3

‎actions/ql/lib/qlpack.yml‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,5 @@
11
name: codeql/actions-all
2-
version: 0.4.3-dev
2+
version: 0.4.4-dev
33
library: true
44
warnOnImplicitThis: true
55
dependencies:

‎actions/ql/src/CHANGELOG.md‎

Lines changed: 26 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1,3 +1,29 @@
1+
## 0.5.0
2+
3+
### Breaking Changes
4+
5+
* The following queries have been removed from the `code-scanning` and `security-extended` suites.
6+
Any existing alerts for these queries will be closed automatically.
7+
* `actions/if-expression-always-true/critical`
8+
* `actions/if-expression-always-true/high`
9+
* `actions/unnecessary-use-of-advanced-config`
10+
11+
* The following query has been moved from the `code-scanning` suite to the `security-extended`
12+
suite. Any existing alerts for this query will be closed automatically unless the analysis is
13+
configured to use the `security-extended` suite.
14+
* `actions/unpinned-tag`
15+
* The following queries have been added to the `security-extended` suite.
16+
* `actions/unversioned-immutable-action`
17+
* `actions/envpath-injection/medium`
18+
* `actions/envvar-injection/medium`
19+
* `actions/code-injection/medium`
20+
* `actions/artifact-poisoning/medium`
21+
* `actions/untrusted-checkout/medium`
22+
23+
### Minor Analysis Improvements
24+
25+
* Fixed false positives in the query `actions/unpinned-tag` (CWE-829), which will no longer flag uses of Docker-based GitHub actions pinned by the container's SHA256 digest.
26+
127
## 0.4.2
228

329
No user-facing changes.

‎actions/ql/src/Security/CWE-829/UnpinnedActionsTag.ql‎

Lines changed: 9 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -23,6 +23,14 @@ private predicate isTrustedOwner(string nwo) {
2323
trustedActionsOwnerDataModel(nwo.substring(0, nwo.indexOf("/")))
2424
}
2525

26+
bindingset[version]
27+
private predicate isPinnedContainer(string version) {
28+
version.regexpMatch("^sha256:[A-Fa-f0-9]{64}$")
29+
}
30+
31+
bindingset[nwo]
32+
private predicate isContainerImage(string nwo) { nwo.regexpMatch("^docker://.+") }
33+
2634
from UsesStep uses, string nwo, string version, Workflow workflow, string name
2735
where
2836
uses.getCallee() = nwo and
@@ -34,7 +42,7 @@ where
3442
) and
3543
uses.getVersion() = version and
3644
not isTrustedOwner(nwo) and
37-
not isPinnedCommit(version) and
45+
not (if isContainerImage(nwo) then isPinnedContainer(version) else isPinnedCommit(version)) and
3846
not isImmutableAction(uses, nwo)
3947
select uses.getCalleeNode(),
4048
"Unpinned 3rd party Action '" + name + "' step $@ uses '" + nwo + "' with ref '" + version +

actions/ql/src/change-notes/2025-02-06-curate-suites.md renamed to actions/ql/src/change-notes/released/0.5.0.md

Lines changed: 8 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,7 @@
1-
---
2-
category: breaking
3-
---
1+
## 0.5.0
2+
3+
### Breaking Changes
4+
45
* The following queries have been removed from the `code-scanning` and `security-extended` suites.
56
Any existing alerts for these queries will be closed automatically.
67
* `actions/if-expression-always-true/critical`
@@ -18,3 +19,7 @@ category: breaking
1819
* `actions/code-injection/medium`
1920
* `actions/artifact-poisoning/medium`
2021
* `actions/untrusted-checkout/medium`
22+
23+
### Minor Analysis Improvements
24+
25+
* Fixed false positives in the query `actions/unpinned-tag` (CWE-829), which will no longer flag uses of Docker-based GitHub actions pinned by the container's SHA256 digest.

‎actions/ql/src/codeql-pack.release.yml‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,2 +1,2 @@
11
---
2-
lastReleaseVersion: 0.4.2
2+
lastReleaseVersion: 0.5.0

‎actions/ql/src/qlpack.yml‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,5 @@
11
name: codeql/actions-queries
2-
version: 0.4.3-dev
2+
version: 0.5.1-dev
33
library: false
44
warnOnImplicitThis: true
55
groups: [actions, queries]

‎actions/ql/test/query-tests/Security/CWE-829/.github/workflows/unpinned_tags.yml‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -9,3 +9,5 @@ jobs:
99
- uses: foo/bar
1010
- uses: foo/bar@v1
1111
- uses: foo/bar@25b062c917b0c75f8b47d8469aff6c94ffd89abb
12+
- uses: docker://foo/bar@latest
13+
- uses: docker://foo/bar@sha256:887a259a5a534f3c4f36cb02dca341673c6089431057242cdc931e9f133147e9

0 commit comments

Comments
 (0)