10000 Merge branch 'main' into java/port/java/string-replace-all-with-non-r… · github/codeql@1ff90bf · GitHub
[go: up one dir, main page]
Skip to content

Commit 1ff90bf

Browse files
owen-mcowen-mc
committed
Merge branch 'main' into java/port/java/string-replace-all-with-non-regex
2 parents 079d774 + e2ed848 commit 1ff90bf

File tree

224 files changed

+14735
-1665
lines changed

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

224 files changed

+14735
-1665
lines changed

‎.github/workflows/build-ripunzip.yml

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -17,7 +17,7 @@ jobs:
1717
strategy:
1818
fail-fast: false
1919
matrix:
20-
os: [ubuntu-20.04, macos-13, windows-2019]
20+
os: [ubuntu-22.04, macos-13, windows-2019]
2121
runs-on: ${{ matrix.os }}
2222
steps:
2323
- uses: actions/checkout@v4

‎.github/workflows/go-tests-rtjo.yml

Lines changed: 22 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,22 @@
1+
name: "Go: Run RTJO Tests"
2+
on:
3+
pull_request:
4+
types:
5+
- labeled
6+
7+
permissions:
8+
contents: read
9+
10+
jobs:
11+
test-linux:
12+
if: "github.repository_owner == 'github' && github.event.label.name == 'Run: RTJO Language Tests'"
13+
name: RTJO Test Linux (Ubuntu)
14+
runs-on: ubuntu-latest-xl
15+
steps:
16+
- name: Check out code
17+
uses: actions/checkout@v4
18+
- name: Run tests
19+
uses: ./go/actions/test
20+
with:
21+
run-code-checks: true
22+
dynamic-join-order-mode: all

‎.github/workflows/ruby-qltest-rtjo.yml

Lines changed: 40 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,40 @@
1+
name: "Ruby: Run RTJO Language Tests"
2+
3+
on:
4+
pull_request:
5+
types:
6+
- opened
7+
- synchronize
8+
- reopened
9+
- labeled
10+
11+
env:
12+
CARGO_TERM_COLOR: always
13+
14+
defaults:
15+
run:
16+
working-directory: ruby
17+
18+
permissions:
19+
contents: read
20+
21+
jobs:
22+
qltest-rtjo:
23+
if: "github.repository_owner == 'github' && github.event.label.name == 'Run: RTJO Language Tests'"
24+
runs-on: ubuntu-latest-xl
25+
strategy:
26+
fail-fast: false
27+
steps:
28+
- uses: actions/checkout@v4
29+
- uses: ./.github/actions/fetch-codeql
30+
- uses: ./ruby/actions/create-extractor-pack
31+
- name: Cache compilation cache
32+
id: query-cache
33+
uses: ./.github/actions/cache-query-compilation
34+
with:
35+
key: ruby-qltest
36+
- name: Run QL tests
37+
run: |
38+
codeql test run --dynamic-join-order-mode=all --threads=0 --ram 50000 --search-path "${{ github.workspace }}" --check-databases --check-undefined-labels --check-unused-labels --check-repeated-labels --check-redefined-labels --check-use-before-definition --consistency-queries ql/consistency-queries ql/test --compilation-cache "${{ steps.query-cache.outputs.cache-dir }}"
39+
env:
40+
GITHUB_TOKEN: ${{ github.token }}

‎actions/ql/lib/change-notes/2025-03-20.md

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,5 @@
1+
---
2+
category: fix
3+
---
4+
* The query `actions/code-injection/medium` now produces alerts for injection
5+
vulnerabilities on `pull_request` events.

‎actions/ql/lib/ext/config/context_event_map.yml

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -30,6 +30,9 @@ extensions:
3030
- ["pull_request_review_comment", "github.event.review"]
3131
- ["pull_request_review_comment", "github.head_ref"]
3232
- ["pull_request_review_comment", "github.event.changes"]
33+
- ["pull_request", "github.event.pull_request"]
34+
- ["pull_request", "github.head_ref"]
35+
- ["pull_request", "github.event.changes"]
3336
- ["pull_request_target", "github.event.pull_request"]
3437
- ["pull_request_target", "github.head_ref"]
3538
- ["pull_request_target", "github.event.changes"]

‎actions/ql/lib/ext/config/externally_triggereable_events.yml

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -12,6 +12,7 @@ extensions:
1212
- ["pull_request_comment"]
1313
- ["pull_request_review"]
1414
- ["pull_request_review_comment"]
15+
- ["pull_request"]
1516
- ["pull_request_target"]
1617
- ["workflow_run"] # depending on branch filter
1718
- ["workflow_call"] # depending on caller

‎actions/ql/src/codeql-suites/actions-ccr.qls renamed to ‎actions/ql/src/codeql-suites/actions-code-quality.qls

File renamed without changes.

‎actions/ql/test/query-tests/Security/CWE-094/CodeInjectionCritical.expected

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -400,6 +400,7 @@ nodes
400400
| .github/workflows/level0.yml:44:20:44:49 | github.event.issue.body | semmle.label | github.event.issue.body |
401401
| .github/workflows/level0.yml:69:35:69:66 | github.event.comment.body | semmle.label | github.event.comment.body |
402402
| .github/workflows/level1.yml:37:38:37:81 | github.event.workflow_run.head_branch | semmle.label | github.event.workflow_run.head_branch |
403+
| .github/workflows/priv_pull_request.yml:14:21:14:57 | github.event.pull_request.body | semmle.label | github.event.pull_request.body |
403404
| .github/workflows/pull_request_review.yml:7:19:7:56 | github.event.pull_request.title | semmle.label | github.event.pull_request.title |
404405
| .github/workflows/pull_request_review.yml:8:19:8:55 | github.event.pull_request.body | semmle.label | github.event.pull_request.body |
405406
| .github/workflows/pull_request_review.yml:9:19:9:61 | github.event.pull_request.head.label | semmle.label | github.event.pull_request.head.label |
@@ -629,6 +630,7 @@ nodes
629630
| .github/workflows/test19.yml:124:9:129:6 | Run Step: title3 [title] | semmle.label | Run Step: title3 [title] |
630631
| .github/workflows/test19.yml:125:14:128:50 | TITLE=$(gh issue view "$ISSUE_NUMBER" --json title,author)\nTITLE=$(echo $TITLE \| jq -r '.title')\necho "title=$TITLE" >> "$GITHUB_OUTPUT"\n | semmle.label | TITLE=$(gh issue view "$ISSUE_NUMBER" --json title,author)\nTITLE=$(echo $TITLE \| jq -r '.title')\necho "title=$TITLE" >> "$GITHUB_OUTPUT"\n |
631632
| .github/workflows/test19.yml:129:21:129:52 | steps.title3.outputs.title | semmle.label | steps.title3.outputs.title |
633+
| .github/workflows/test20.yml:15:54:15:94 | github.event.pull_request.head.ref | semmle.label | github.event.pull_request.head.ref |
632634
| .github/workflows/test21.yml:22:35:22:73 | github.event.head_commit.message | semmle.label | github.event.head_commit.message |
633635
| .github/workflows/test21.yml:23:36:23:74 | github.event.head_commit.message | semmle.label | github.event.head_commit.message |
634636
| .github/workflows/test21.yml:24:50:24:88 | github.event.head_commit.message | semmle.label | github.event.head_commit.message |

‎actions/ql/test/query-tests/Security/CWE-094/CodeInjectionMedium.expected

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -400,6 +400,7 @@ nodes
400400
| .github/workflows/level0.yml:44:20:44:49 | github.event.issue.body | semmle.label | github.event.issue.body |
401401
| .github/workflows/level0.yml:69:35:69:66 | github.event.comment.body | semmle.label | github.event.comment.body |
402402
| .github/workflows/level1.yml:37:38:37:81 | github.event.workflow_run.head_branch | semmle.label | github.event.workflow_run.head_branch |
403+
| .github/workflows/priv_pull_request.yml:14:21:14:57 | github.event.pull_request.body | semmle.label | github.event.pull_request.body |
403404
| .github/workflows/pull_request_review.yml:7:19:7:56 | github.event.pull_request.title | semmle.label | github.event.pull_request.title |
404405
| .github/workflows/pull_request_review.yml:8:19:8:55 | github.event.pull_request.body | semmle.label | github.event.pull_request.body |
405406
| .github/workflows/pull_request_review.yml:9:19:9:61 | github.event.pull_request.head.label | semmle.label | github.event.pull_request.head.label |
@@ -629,6 +630,7 @@ nodes
629630
| .github/workflows/test19.yml:124:9:129:6 | Run Step: title3 [title] | semmle.label | Run Step: title3 [title] |
630631
| .github/workflows/test19.yml:125:14:128:50 | TITLE=$(gh issue view "$ISSUE_NUMBER" --json title,author)\nTITLE=$(echo $TITLE \| jq -r '.title')\necho "title=$TITLE" >> "$GITHUB_OUTPUT"\n | semmle.label | TITLE=$(gh issue view "$ISSUE_NUMBER" --json title,author)\nTITLE=$(echo $TITLE \| jq -r '.title')\necho "title=$TITLE" >> "$GITHUB_OUTPUT"\n |
631632
| .github/workflows/test19.yml:129:21:129:52 | steps.title3.outputs.title | semmle.label | steps.title3.outputs.title |
633+
| .github/workflows/test20.yml:15:54:15:94 | github.event.pull_request.head.ref | semmle.label | github.event.pull_request.head.ref |
632634
| .github/workflows/test21.yml:22:35:22:73 | github.event.head_commit.message | semmle.label | github.event.head_commit.message |
633635
| .github/workflows/test21.yml:23:36:23:74 | github.event.head_commit.message | semmle.label | github.event.head_commit.message |
634636
| .github/workflows/test21.yml:24:50:24:88 | github.event.head_commit.message | semmle.label | github.event.head_commit.message |
@@ -706,6 +708,7 @@ subpaths
706708
| .github/workflows/inter-job2.yml:45:20:45:53 | needs.job1.outputs.job_output | .github/workflows/inter-job2.yml:22:9:26:6 | Uses Step: source | .github/workflows/inter-job2.yml:45:20:45:53 | needs.job1.outputs.job_output | Potential code injection in $@, which may be controlled by an external user. | .github/workflows/inter-job2.yml:45:20:45:53 | needs.job1.outputs.job_output | ${{needs.job1.outputs.job_output}} |
707709
| .github/workflows/inter-job4.yml:44:20:44:53 | needs.job1.outputs.job_output | .github/workflows/inter-job4.yml:22:9:26:6 | Uses Step: source | .github/workflows/inter-job4.yml:44:20:44:53 | needs.job1.outputs.job_output | Potential code injection in $@, which may be controlled by an external user. | .github/workflows/inter-job4.yml:44:20:44:53 | needs.job1.outputs.job_output | ${{needs.job1.outputs.job_output}} |
708710
| .github/workflows/inter-job5.yml:45:20:45:53 | needs.job1.outputs.job_output | .github/workflows/inter-job5.yml:45:20:45:53 | needs.job1.outputs.job_output | .github/workflows/inter-job5.yml:45:20:45:53 | needs.job1.outputs.job_output | Potential code injection in $@, which may be controlled by an external user. | .github/workflows/inter-job5.yml:45:20:45:53 | needs.job1.outputs.job_output | ${{needs.job1.outputs.job_output}} |
711+
| .github/workflows/priv_pull_request.yml:14:21:14:57 | github.event.pull_request.body | .github/workflows/priv_pull_request.yml:14:21:14:57 | github.event.pull_request.body | .github/workflows/priv_pull_request.yml:14:21:14:57 | github.event.pull_request.body | Potential code injection in $@, which may be controlled by an external user. | .github/workflows/priv_pull_request.yml:14:21:14:57 | github.event.pull_request.body | ${{ github.event.pull_request.body }} |
709712
| .github/workflows/push.yml:7:19:7:57 | github.event.commits[11].message | .github/workflows/push.yml:7:19:7:57 | github.event.commits[11].message | .github/workflows/push.yml:7:19:7:57 | github.event.commits[11].message | Potential code injection in $@, which may be controlled by an external user. | .github/workflows/push.yml:7:19:7:57 | github.event.commits[11].message | ${{ github.event.commits[11].message }} |
710713
| .github/workflows/push.yml:8:19:8:62 | github.event.commits[11].author.email | .github/workflows/push.yml:8:19:8:62 | github.event.commits[11].author.email | .github/workflows/push.yml:8:19:8:62 | github.event.commits[11].author.email | Potential code injection in $@, which may be controlled by an external user. | .github/workflows/push.yml:8:19:8:62 | github.event.commits[11].author.email | ${{ github.event.commits[11].author.email }} |
711714
| .github/workflows/push.yml:9:19:9:61 | github.event.commits[11].author.name | .github/workflows/push.yml:9:19:9:61 | github.event.commits[11].author.name | .github/workflows/push.yml:9:19:9:61 | github.event.commits[11].author.name | Potential code injection in $@, which may be controlled by an external user. | .github/workflows/push.yml:9:19:9:61 | github.event.commits[11].author.name | ${{ github.event.commits[11].author.name }} |

‎cpp/ql/src/codeql-suites/cpp-ccr.qls renamed to ‎cpp/ql/src/codeql-suites/cpp-code-quality.qls

File renamed without changes.

‎csharp/extractor/Semmle.Extraction.CSharp.DependencyFetching/DependabotProxy.cs

Lines changed: 47 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,14 +1,22 @@
11
using System;
2-
using System.Diagnostics;
2+
using System.Collections.Generic;
33
using System.IO;
44
using System.Security.Cryptography.X509Certificates;
55
using Semmle.Util;
66
using Semmle.Util.Logging;
7+
using Newtonsoft.Json;
78

89
namespace Semmle.Extraction.CSharp.DependencyFetching
910
{
1011
public class DependabotProxy : IDisposable
1112
{
13+
/// <summary>
14+
/// Represents configurations for package registries.
15+
/// </summary>
16+
/// <param name="Type">The type of package registry.</param>
17+
/// <param name="URL">The URL of the package registry.</param>
18+
public record class RegistryConfig(string Type, string URL);
19+
1220
private readonly string host;
1321
private readonly string port;
1422

@@ -17,6 +25,10 @@ public class DependabotProxy : IDisposable
1725
/// </summary>
1826
internal string Address { get; }
1927
/// <summary>
28+
/// The URLs of package registries that are configured for the proxy.
29+
/// </summary>
30+
internal HashSet<string> RegistryURLs { get; }
31+
/// <summary>
2032
/// The path to the temporary file where the certificate is stored.
2133
/// </summary>
2234
internal string? CertificatePath { get; private set; }
@@ -67,6 +79,39 @@ public class DependabotProxy : IDisposable
6779
result.Certificate = X509Certificate2.CreateFromPem(cert);
6880
}
6981

82+
// Try to obtain the list of private registry URLs.
83+
var registryURLs = Environment.GetEnvironmentVariable(EnvironmentVariableNames.ProxyURLs);
84+
85+
if (!string.IsNullOrWhiteSpace(registryURLs))
86+
{
87+
try
88+
{
89+
// The value of the environment variable should be a JSON array of objects, such as:
90+
// [ { "type": "nuget_feed", "url": "https://nuget.pkg.github.com/org/index.json" } ]
91+
var array = JsonConvert.DeserializeObject<List<RegistryConfig>>(registryURLs);
92+
if (array is not null)
93+
{
94+
foreach (RegistryConfig config in array)
95+
{
96+
// The array contains all configured private registries, not just ones for C#.
97+
// We ignore the non-C# ones here.
98+
if (!config.Type.Equals("nuget_feed"))
99+
{
100+
logger.LogDebug($"Ignoring registry at '{config.URL}' since it is not of type 'nuget_feed'.");
101+
continue;
102+
}
103+
104+
logger.LogInfo($"Found private registry at '{config.URL}'");
105+
result.RegistryURLs.Add(config.URL);
106+
}
107+
}
108+
}
109+
catch (JsonException ex)
110+
{
111+
logger.LogError($"Unable to parse '{EnvironmentVariableNames.ProxyURLs}': {ex.Message}");
112+
}
113+
}
114+
70115
return result;
71116
}
72117

@@ -75,6 +120,7 @@ private DependabotProxy(string host, string port)
75120
this.host = host;
76121
this.port = port;
77122
this.Address = $"http://{this.host}:{this.port}";
123+
this.RegistryURLs = new HashSet<string>();
78124
}
79125

80126
public void Dispose()

‎csharp/extractor/Semmle.Extraction.CSharp.DependencyFetching/DotNet.cs

Lines changed: 5 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -2,7 +2,6 @@
22
using System.Collections.Generic;
33
using System.IO;
44
using System.Linq;
5-
65
using Newtonsoft.Json.Linq;
76

87
using Semmle.Util;
@@ -77,6 +76,11 @@ private string GetRestoreArgs(RestoreSettings restoreSettings)
7776
args += " /p:EnableWindowsTargeting=true";
7877
}
7978

79+
if (restoreSettings.ExtraArgs is not null)
80+
{
81+
args += $" {restoreSettings.ExtraArgs}";
82+
}
83+
8084
return args;
8185
}
8286

‎csharp/extractor/Semmle.Extraction.CSharp.DependencyFetching/EnvironmentVariableNames.cs

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -89,5 +89,10 @@ internal static class EnvironmentVariableNames
8989
/// Contains the certificate used by the Dependabot proxy.
9090
/// </summary>
9191
public const string ProxyCertificate = "CODEQL_PROXY_CA_CERTIFICATE";
92+
93+
/// <summary>
94+
/// Contains the URLs of private nuget registries as a JSON array.
95+
/// </summary>
96+
public const string ProxyURLs = "CODEQL_PROXY_URLS";
9297
}
9398
}

‎csharp/extractor/Semmle.Extraction.CSharp.DependencyFetching/IDotNet.cs

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -17,7 +17,7 @@ public interface IDotNet
1717
IList<string> GetNugetFeedsFromFolder(string folderPath);
1818
}
1919

20-
public record class RestoreSettings(string File, string PackageDirectory, bool ForceDotnetRefAssemblyFetching, string? PathToNugetConfig = null, bool ForceReevaluation = false, bool TargetWindows = false);
20+
public record class RestoreSettings(string File, string PackageDirectory, bool ForceDotnetRefAssemblyFetching, string? ExtraArgs = null, string? PathToNugetConfig = null, bool ForceReevaluation = false, bool TargetWindows = false);
2121

2222
public partial record class RestoreResult(bool Success, IList<string> Output)
2323
{

0 commit comments

Comments
 (0)
0