Skip to content

Commit f28140b

Browse files
redsun82redsun82
authored
Merge branch 'main' into redsun82/env-dump-integration-test
2 parents 13f1f8f + 8fca150 commit f28140b

File tree

2,084 files changed

+100607
-57585
lines changed

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

2,084 files changed

+100607
-57585
lines changed

‎.bazelrc

+3
Original file line numberDiff line numberDiff line change
@@ -2,6 +2,9 @@ common --enable_platform_specific_config
22
# because we use --override_module with `%workspace%`, the lock file is not stable
33
common --lockfile_mode=off
44

5+
# Build release binaries by default, can be overwritten to in local.bazelrc and set to `fastbuild` or `dbg`
6+
build --compilation_mode opt
7+
58
# when building from this repository in isolation, the internal repository will not be found at ..
69
# where `MODULE.bazel` looks for it. The following will get us past the module loading phase, so
710
# that we can build things that do not rely on that

‎.github/pull_request_template.md

-14
This file was deleted.

‎MODULE.bazel

+3-12
Original file line numberDiff line numberDiff line change
@@ -14,7 +14,7 @@ local_path_override(
1414

1515
# see https://registry.bazel.build/ for a list of available packages
1616

17-
bazel_dep(name = "platforms", version = "0.0.10")
17+
bazel_dep(name = "platforms", version = "0.0.11")
1818
bazel_dep(name = "rules_go", version = "0.50.1")
1919
bazel_dep(name = "rules_pkg", version = "1.0.1")
2020
bazel_dep(name = "rules_nodejs", version = "6.2.0-codeql.1")
@@ -28,7 +28,7 @@ bazel_dep(name = "rules_kotlin", version = "2.0.0-codeql.1")
2828
bazel_dep(name = "gazelle", version = "0.40.0")
2929
bazel_dep(name = "rules_dotnet", version = "0.17.4")
3030
bazel_dep(name = "googletest", version = "1.14.0.bcr.1")
31-
bazel_dep(name = "rules_rust", version = "0.52.2")
31+
bazel_dep(name = "rules_rust", version = "0.57.1")
3232
bazel_dep(name = "zstd", version = "1.5.5.bcr.1")
3333

3434
bazel_dep(name = "buildifier_prebuilt", version = "6.4.0", dev_dependency = True)
@@ -53,15 +53,6 @@ use_repo(rust, "rust_toolchains")
5353

5454
register_toolchains("@rust_toolchains//:all")
5555

56-
rust_host_tools = use_extension("@rules_rust//rust:extensions.bzl", "rust_host_tools")
57-
58-
# Don't download a second toolchain as host toolchain, make sure this is the same version as above
59-
# The host toolchain is used for vendoring dependencies.
60-
rust_host_tools.host_tools(
61-
edition = RUST_EDITION,
62-
version = RUST_VERSION,
63-
)
64-
6556
# deps for python extractor
6657
# keep in sync by running `misc/bazel/3rdparty/update_cargo_deps.sh`
6758
py_deps = use_extension("//misc/bazel/3rdparty:py_deps_extension.bzl", "p")
@@ -252,7 +243,7 @@ use_repo(
252243
)
253244

254245
go_sdk = use_extension("@rules_go//go:extensions.bzl", "go_sdk")
255-
go_sdk.download(version = "1.23.1")
246+
go_sdk.download(version = "1.24.0")
256247

257248
go_deps = use_extension("@gazelle//:extensions.bzl", "go_deps")
258249
go_deps.from_file(go_mod = "//go/extractor:go.mod")

‎actions/ql/lib/CHANGELOG.md

+7
Original file line numberDiff line numberDiff line change
@@ -1,3 +1,10 @@
1+
## 0.4.2
2+
3+
### Bug Fixes
4+
5+
* Fixed data for vulnerable versions of `actions/download-artifact` and `rlespinasse/github-slug-action` (following GHSA-cxww-7g56-2vh6 and GHSA-6q4m-7476-932w).
6+
* Improved `untrustedGhCommandDataModel` regex for `gh pr view` and Bash taint analysis in GitHub Actions.
7+
18
## 0.4.1
29

310
No user-facing changes.

‎actions/ql/lib/change-notes/2025-01-07-trusted-owner-ext.md

+4
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,4 @@
1+
---
2+
category: feature
3+
---
4+
* The "Unpinned tag for a non-immutable Action in workflow" query (`actions/unpinned-tag`) now supports expanding the trusted action owner list using data extensions (`extensible: trustedActionsOwnerDataModel`). If you trust an Action publisher, you can include the owner name/organization in a model pack to add it to the allow list for this query. This addition will prevent security alerts when using unpinned tags for Actions published by that owner. For more information on creating a model pack, see [Creating a CodeQL Model Pack](https://docs.github.com/en/code-security/codeql-cli/using-the-advanced-functionality-of-the-codeql-cli/creating-and-working-with-codeql-packs#creating-a-codeql-model-pack).

‎actions/ql/lib/change-notes/released/0.4.2.md

+6
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,6 @@
1+
## 0.4.2
2+
3+
### Bug Fixes
4+
5+
* Fixed data for vulnerable versions of `actions/download-artifact` and `rlespinasse/github-slug-action` (following GHSA-cxww-7g56-2vh6 and GHSA-6q4m-7476-932w).
6+
* Improved `untrustedGhCommandDataModel` regex for `gh pr view` and Bash taint analysis in GitHub Actions.

‎actions/ql/lib/codeql-pack.release.yml

+1-1
Original file line numberDiff line numberDiff line change
@@ -1,2 +1,2 @@
11
---
2-
lastReleaseVersion: 0.4.1
2+
lastReleaseVersion: 0.4.2

‎actions/ql/lib/codeql/actions/Bash.qll

+16-1
Original file line numberDiff line numberDiff line change
@@ -81,7 +81,9 @@ class BashShellScript extends ShellScript {
8181
"qstr:" + k + ":" + i + ":" + j + ":" + quotedStr.length() + ":" +
8282
quotedStr.regexpReplaceAll("[^a-zA-Z0-9]", "")
8383
)
84-
)
84+
) and
85+
// Only do this for strings that might otherwise disrupt subsequent parsing
86+
quotedStr.regexpMatch("[\"'].*[$\n\r'\"" + Bash::separator() + "].*[\"']")
8587
}
8688

8789
private predicate rankedQuotedStringReplacements(int i, string old, string new) {
@@ -695,6 +697,19 @@ module Bash {
695697
not varMatchesRegexTest(script, var2, alphaNumericRegex())
696698
)
697699
or
700+
exists(string var2, string value2, string var3, string value3 |
701+
// VAR2=$(cmd)
702+
// VAR3=$VAR2
703+
// echo "FIELD=${VAR3:-default}" >> $GITHUB_ENV (field, file_write_value)
704+
containsCmdSubstitution(value2, cmd) and
705+
script.getAnAssignment(var2, value2) and
706+
containsParameterExpansion(value3, var2, _, _) and
707+
script.getAnAssignment(var3, value3) and
708+
containsParameterExpansion(expr, var3, _, _) and
709+
not varMatchesRegexTest(script, var2, alphaNumericRegex()) and
710+
not varMatchesRegexTest(script, var3, alphaNumericRegex())
711+
)
712+
or
698713
// var reaches the file write directly
699714
// echo "FIELD=$(cmd)" >> $GITHUB_ENV (field, file_write_value)
700715
containsCmdSubstitution(expr, cmd)

‎actions/ql/lib/codeql/actions/config/Config.qll

+9
Original file line numberDiff line numberDiff line change
@@ -126,6 +126,15 @@ predicate vulnerableActionsDataModel(
126126
*/
127127
predicate immutableActionsDataModel(string action) { Extensions::immutableActionsDataModel(action) }
128128

129+
/**
130+
* MaD models for trusted actions owners
131+
* Fields:
132+
* - owner: owner name
133+
*/
134+
predicate trustedActionsOwnerDataModel(string owner) {
135+
Extensions::trustedActionsOwnerDataModel(owner)
136+
}
137+
129138
/**
130139
* MaD models for untrusted git commands
131140
* Fields:

‎actions/ql/lib/codeql/actions/config/ConfigExtensions.qll

+5
Original file line numberDiff line numberDiff line change
@@ -63,6 +63,11 @@ extensible predicate vulnerableActionsDataModel(
6363
*/
6464
extensible predicate immutableActionsDataModel(string action);
6565

66+
/**
67+
* Holds for trusted Actions owners.
68+
*/
69+
extensible predicate trustedActionsOwnerDataModel(string owner);
70+
6671
/**
6772
* Holds for git commands that may introduce untrusted data when called on an attacker controlled branch.
6873
*/

‎actions/ql/lib/codeql/actions/controlflow/internal/Cfg.qll

+4
Original file line numberDiff line numberDiff line change
@@ -134,6 +134,10 @@ private module Implementation implements CfgShared::InputSig<Location> {
134134
SuccessorType getAMatchingSuccessorType(Completion c) { result = c.getAMatchingSuccessorType() }
135135

136136
predicate isAbnormalExitType(SuccessorType t) { none() }
137+
138+
int idOfAstNode(AstNode node) { none() }
139+
140+
int idOfCfgScope(CfgScope scope) { none() }
137141
}
138142

139143
module CfgImpl = CfgShared::Make<Location, Implementation>;

‎actions/ql/lib/ext/config/trusted_actions_owner.yml

+8
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,8 @@
1+
extensions:
2+
- addsTo:
3+
pack: codeql/actions-all
4+
extensible: trustedActionsOwnerDataModel
5+
data:
6+
- ["actions"]
7+
- ["github"]
8+
- ["advanced-security"]

‎actions/ql/lib/ext/config/untrusted_gh_command.yml

+12-9
Original file line numberDiff line numberDiff line change
@@ -7,26 +7,29 @@ extensions:
77
# PULL REQUESTS
88
#
99
# HEAD_REF=$(gh pr view "${{ github.event.issue.number }}" --json headRefName -q '.headRefName')
10-
- ["gh\\s+pr\\b.*\\bview\\b.*\\.headRefName.*", "branch,oneline"]
10+
- ["gh\\s+pr\\b.*\\bview\\b.*\\bheadRefName\\b", "branch,oneline"]
1111
# TITLE=$(gh pr view $PR_NUMBER --json title --jq .title)
12-
- ["gh\\s+pr\\b.*\\bview\\b.*\\.title.*", "title,oneline"]
12+
# TITLE=$(gh pr view $PR_NUMBER --json "title")
13+
- ["gh\\s+pr\\b.*\\bview\\b.*\\btitle\\b", "title,oneline"]
1314
# BODY=$(gh pr view $PR_NUMBER --json body --jq .body)
14-
- ["gh\\s+pr\\b.*\\bview\\b.*\\.body.*", "text,multiline"]
15+
- ["gh\\s+pr\\b.*\\bview\\b.*\\bbody\\b", "text,multiline"]
1516
# COMMENTS="$(gh pr view --repo ${{ github.repository }} "$PR_NUMBER" --json "body,comments" -q '.body, .comments[].body')"
16-
- ["gh\\s+pr\\b.*\\bview\\b.*\\.comments.*", "text,multiline"]
17+
- ["gh\\s+pr\\b.*\\bview\\b.*\\bcomments\\b", "text,multiline"]
1718
# CHANGED_FILES="$(gh pr view --repo ${{ github.repository }} ${{ needs.check-comment.outputs.pull_number }} --json files --jq '.files.[].path')"
18-
- ["gh\\s+pr\\b.*\\bview\\b.*\\.files.*", "filename,multiline"]
19+
- ["gh\\s+pr\\b.*\\bview\\b.*\\bfiles\\b", "filename,multiline"]
1920
# AUTHOR=$(gh pr view ${ORI_PR} -R ${REPO} --json author -q '.author.login')
20-
- ["gh\\s+pr\\b.*\\bview\\b.*\\.author.*", "username,oneline"]
21+
- ["gh\\s+pr\\b.*\\bview\\b.*\\bauthor\\b", "username,oneline"]
2122
#
2223
# ISSUES
2324
#
2425
# TITLE=$(gh issue view "$ISSUE_NUMBER" --json title --jq '.title')
25-
- ["gh\\s+issue\\b.*\\bview\\b.*\\.title.*", "title,oneline"]
26+
# TITLE=$(gh issue view "$ISSUE_NUMBER" --json title,body)
27+
# TITLE=$(gh issue view "$ISSUE_NUMBER" --json "title,body")
28+
- ["gh\\s+issue\\b.*\\bview\\b.*\\btitle\\b", "title,oneline"]
2629
# BODY=$(gh issue view -R ${GITHUB_REPOSITORY} ${ORIGINAL_ISSUE_NUMBER} --json title,body,assignees --jq .body)
27-
- ["gh\\s+issue\\b.*\\bview\\b.*\\.body.*", "text,multiline"]
30+
- ["gh\\s+issue\\b.*\\bview\\b.*\\bbody\\b", "text,multiline"]
2831
# COMMENTS=$(gh issue view "$ISSUE_NUMBER" --json comments --jq '.comments[].body')
29-
- ["gh\\s+issue\\b.*\\bview\\b.*\\.comments.*", "text,multiline"]
32+
- ["gh\\s+issue\\b.*\\bview\\b.*\\bcomments\\b", "text,multiline"]
3033
#
3134
# API
3235
#

‎actions/ql/lib/ext/config/vulnerable_actions.yml

+6-60
Original file line numberDiff line numberDiff line change
@@ -6,38 +6,12 @@ extensions:
66

77
# gh api /repos/actions/download-artifact/tags --jq 'map({name: .name, sha: .commit.sha})' --paginate | jq -r '.[] | "- \"\(.name)\", \"\(.sha)\""'
88

9-
#
109
# actions/download-artifact
11-
- ["actions/download-artifact", "v4.1.6", "9c19ed7fe5d278cd354c7dfd5d3b88589c7e2395", "4.1.7"]
12-
- ["actions/download-artifact", "v4.1.5", "8caf195ad4b1dee92908e23f56eeb0696f1dd42d", "4.1.7"]
13-
- ["actions/download-artifact", "v4.1.4", "c850b930e6ba138125429b7e5c93fc707a7f8427", "4.1.7"]
14-
- ["actions/download-artifact", "v4.1.3", "87c55149d96e628cc2ef7e6fc2aab372015aec85", "4.1.7"]
15-
- ["actions/download-artifact", "v4.1.2", "eaceaf801fd36c7dee90939fad912460b18a1ffe", "4.1.7"]
16-
- ["actions/download-artifact", "v4.1.1", "6b208ae046db98c579e8a3aa621ab581ff575935", "4.1.7"]
17-
- ["actions/download-artifact", "v4.1.0", "f44cd7b40bfd40b6aa1cc1b9b5b7bf03d3c67110", "4.1.7"]
18-
- ["actions/download-artifact", "v4.0.0", "7a1cd3216ca9260cd8022db641d960b1db4d1be4", "4.1.7"]
19-
- ["actions/download-artifact", "v3.0.2", "9bc31d5ccc31df68ecc42ccf4149144866c47d8a", "4.1.7"]
20-
- ["actions/download-artifact", "v3.0.1", "9782bd6a9848b53b110e712e20e42d89988822b7", "4.1.7"]
21-
- ["actions/download-artifact", "v3.0.0", "fb598a63ae348fa914e94cd0ff38f362e927b741", "4.1.7"]
22-
- ["actions/download-artifact", "v3", "9bc31d5ccc31df68ecc42ccf4149144866c47d8a", "4.1.7"]
23-
- ["actions/download-artifact", "v3-node20", "246d7188e736d3686f6d19628d253ede9697bd55", "4.1.7"]
24-
- ["actions/download-artifact", "v2.1.1", "cbed621e49e4c01b044d60f6c80ea4ed6328b281", "4.1.7"]
25-
- ["actions/download-artifact", "v2.1.0", "f023be2c48cc18debc3bacd34cb396e0295e2869", "4.1.7"]
26-
- ["actions/download-artifact", "v2.0.10", "3be87be14a055c47b01d3bd88f8fe02320a9bb60", "4.1.7"]
27-
- ["actions/download-artifact", "v2.0.9", "158ca71f7c614ae705e79f25522ef4658df18253", "4.1.7"]
28-
- ["actions/download-artifact", "v2.0.8", "4a7a711286f30c025902c28b541c10e147a9b843", "4.1.7"]
29-
- ["actions/download-artifact", "v2.0.7", "f144d3c3916a86f4d6b11ff379d17a49d8f85dbc", "4.1.7"]
30-
- ["actions/download-artifact", "v2.0.6", "f8e41fbffeebb48c0273438d220bb2387727471f", "4.1.7"]
31-
- ["actions/download-artifact", "v2.0.5", "c3f5d00c8784369c43779f3d2611769594a61f7a", "4.1.7"]
32-
- ["actions/download-artifact", "v2.0.4", "b3cedea9bed36890c824f4065163b667eeca272b", "4.1.7"]
33-
- ["actions/download-artifact", "v2.0.3", "80d2d4023c185001eacb50e37afd7dd667ba8044", "4.1.7"]
34-
- ["actions/download-artifact", "v2.0.2", "381af06b4268a1e0ad7b7c7e5a09f1894977120f", "4.1.7"]
35-
- ["actions/download-artifact", "v2.0.1", "1ac47ba4b6af92e65d0438b64ce1ea49ce1cc48d", "4.1.7"]
36-
- ["actions/download-artifact", "v2.0", "1de1dea89c32dcb1f37183c96fe85cfe067b682a", "4.1.7"]
37-
- ["actions/download-artifact", "v2", "cbed621e49e4c01b044d60f6c80ea4ed6328b281", "4.1.7"]
38-
- ["actions/download-artifact", "v1.0.0", "18f0f591fbc635562c815484d73b6e8e3980482e", "4.1.7"]
39-
- ["actions/download-artifact", "v1", "18f0f591fbc635562c815484d73b6e8e3980482e", "4.1.7"]
40-
- ["actions/download-artifact", "1.0.0", "18f0f591fbc635562c815484d73b6e8e3980482e", "4.1.7"]
10+
# https://github.com/advisories/GHSA-cxww-7g56-2vh6 Affected versions: >= 4.0.0, < 4.1.3
11+
- ["actions/download-artifact", "v4.1.2", "eaceaf801fd36c7dee90939fad912460b18a1ffe", "4.1.3"]
12+
- ["actions/download-artifact", "v4.1.1", "6b208ae046db98c579e8a3aa621ab581ff575935", "4.1.3"]
13+
- ["actions/download-artifact", "v4.1.0", "f44cd7b40bfd40b6aa1cc1b9b5b7bf03d3c67110", "4.1.3"]
14+
- ["actions/download-artifact", "v4.0.0", "7a1cd3216ca9260cd8022db641d960b1db4d1be4", "4.1.3"]
4115

4216
# tj-actions/changed-files
4317
# https://github.com/advisories/GHSA-mcph-m25j-8j63
@@ -530,22 +504,13 @@ extensions:
530504
- ["gradle/gradle-build-action", "v1", "b3afdc78a7849557ab26e243ccf07548086da025", "2.4.2"]
531505

532506
# rlespinasse/github-slug-action
533-
# https://github.com/advisories/GHSA-6q4m-7476-932w
507+
# https://github.com/advisories/GHSA-6q4m-7476-932w Affected versions: >= 4.0.0, < 4.4.1
534508
# CVE-2023-27581
535-
- ["rlespinasse/github-slug-action", "v4.4.1", "102b1a064a9b145e56556e22b18b19c624538d94", "4.4.1"]
536509
- ["rlespinasse/github-slug-action", "v4.4.0", "a362e5fb42057a3a23a62218b050838f1bacca5d", "4.4.1"]
537510
- ["rlespinasse/github-slug-action", "v4.3.2", "b011e83cf8cb29e22dda828db30586691ae164e4", "4.4.1"]
538511
- ["rlespinasse/github-slug-action", "v4.3.1", "00198f89920d4454e37e4b27af2b7a8eba79c530", "4.4.1"]
539512
- ["rlespinasse/github-slug-action", "v4.3.0", "9c3571fd3dba541bfdaebc001482a49a1c1f136a", "4.4.1"]
540513
- ["rlespinasse/github-slug-action", "v4.2.5", "0141d9b38d1f21c3b3de63229e20b7b0ad7ef0f4", "4.4.1"]
541-
- ["rlespinasse/github-slug-action", "v3.9.0", "2daab132aa3a6e23ea9d409f9946b3bf6468cc77", "4.4.1"]
542-
- ["rlespinasse/github-slug-action", "v3.8.0", "4a00c29bc1c0a737315b4200af6c6991bb4ace18", "4.4.1"]
543-
- ["rlespinasse/github-slug-action", "v3.7.1", "5150a26d43ce06608443c66efea46fc6f3c50d38", "4.4.1"]
544-
- ["rlespinasse/github-slug-action", "v3.7.0", "ebfc49c0e9cd081acb7ba0634d8d6a711b4c73cf", "4.4.1"]
545-
- ["rlespinasse/github-slug-action", "v3", "2daab132aa3a6e23ea9d409f9946b3bf6468cc77", "4.4.1"]
546-
- ["rlespinasse/github-slug-action", "v3.x", "2daab132aa3a6e23ea9d409f9946b3bf6468cc77", "4.4.1"]
547-
- ["rlespinasse/github-slug-action", "v2.x", "9d2c65418d6ecbbd3c08e686997b30482e9f4a80", "4.4.1"]
548-
- ["rlespinasse/github-slug-action", "v1.1.x", "fbf6d7b9c7af4e8d06135dbc7d774e717d788731", "4.4.1"]
549514
- ["rlespinasse/github-slug-action", "4.2.5", "0141d9b38d1f21c3b3de63229e20b7b0ad7ef0f4", "4.4.1"]
550515
- ["rlespinasse/github-slug-action", "4.2.4", "33cd7a701db9c2baf4ad705d930ade51a9f25c14", "4.4.1"]
551516
- ["rlespinasse/github-slug-action", "4.2.3", "1615fcb48b5315152b3733b7bed1a9f5dfada6e3", "4.4.1"]
@@ -555,25 +520,6 @@ extensions:
555520
- ["rlespinasse/github-slug-action", "4.1.0", "88f3ee8f6f5d1955de92f1fe2fdb301fd40207c6", "4.4.1"]
556521
- ["rlespinasse/github-slug-action", "4.0.1", "cd9871b66e11e9562e3f72469772fe100be4c95a", "4.4.1"]
557522
- ["rlespinasse/github-slug-action", "4.0.0", "bd31a9f564f7930eea1ecfc8d0e6aebc4bc3279f", "4.4.1"]
558-
- ["rlespinasse/github-slug-action", "3.6.1", "1bf76b7bc6ef7dc6ba597ff790f956d9082479d7", "4.4.1"]
559-
- ["rlespinasse/github-slug-action", "3.6.0", "172fe43594a58b5938e248ec757ada60cdb17e18", "4.4.1"]
560-
- ["rlespinasse/github-slug-action", "3.5.1", "016823880d193a56b180527cf7ee52f13c3cfe33", "4.4.1"]
561-
- ["rlespinasse/github-slug-action", "3.5.0", "4060fda2690bcebaabcd86db4fbc8e1c2817c835", "4.4.1"]
562-
- ["rlespinasse/github-slug-action", "3.4.0", "0c099abd978b382cb650281af13913c1905fdd50", "4.4.1"]
563-
- ["rlespinasse/github-slug-action", "3.3.0", "d1880ea5b39f611effb9f3f83f4d35bff34083a6", "4.4.1"]
564-
- ["rlespinasse/github-slug-action", "3.2.0", "c8d8ee50d00177c1e80dd57905fc61f81e437279", "4.4.1"]
565-
- ["rlespinasse/github-slug-action", "3.1.0", "e4699e49fcf890a3172a02c56ba78d867dbb9fd5", "4.4.1"]
566-
- ["rlespinasse/github-slug-action", "3.0.0", "6a873bec5ac11c6d2a11756b8763356da63a8939", "4.4.1"]
567-
- ["rlespinasse/github-slug-action", "2.2.0", "9d2c65418d6ecbbd3c08e686997b30482e9f4a80", "4.4.1"]
568-
- ["rlespinasse/github-slug-action", "2.1.1", "72cfc4cb1f36c102c48541cb59511a6267e89c95", "4.4.1"]
569-
- ["rlespinasse/github-slug-action", "2.1.0", "1172ed1802078eb665a55c252fc180138b907c51", "4.4.1"]
570-
- ["rlespinasse/github-slug-action", "2.0.0", "ca9a67fa1f1126b377a9d80dc1ea354284c71d21", "4.4.1"]
571-
- ["rlespinasse/github-slug-action", "1.2.0", "fbf6d7b9c7af4e8d06135dbc7d774e717d788731", "4.4.1"]
572-
- ["rlespinasse/github-slug-action", "1.1.1", "242e04c2d28ac5db296e5d8203dfd7dc6bcc17a9", "4.4.1"]
573-
- ["rlespinasse/github-slug-action", "1.1.0", "881085bcae8c3443a89cc9401f3e1c60fb014ed2", "4.4.1"]
574-
- ["rlespinasse/github-slug-action", "1.0.2", "a35a1a486a260cfd99c5b6f8c6034a2929ba9b3f", "4.4.1"]
575-
- ["rlespinasse/github-slug-action", "1.0.1", "e46186066296e23235242d0877e2b4fe54003d54", "4.4.1"]
576-
- ["rlespinasse/github-slug-action", "1.0.0", "9671420482a6e4c59c06f2d2d9e0605e941b1287", "4.4.1"]
577523

578524
# Azure/setup-kubectl
579525
# https://github.com/advisories/GHSA-p756-rfxh-x63h

‎actions/ql/lib/qlpack.yml

+1-1
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,5 @@
11
name: codeql/actions-all
2-
version: 0.4.2-dev
2+
version: 0.4.3-dev
33
library: true
44
warnOnImplicitThis: true
55
dependencies:

‎actions/ql/src/CHANGELOG.md

+4
Original file line numberDiff line numberDiff line change
@@ -1,3 +1,7 @@
1+
## 0.4.2
2+
3+
No user-facing changes.
4+
15
## 0.4.1
26

37
No user-facing changes.

‎actions/ql/src/Security/CWE-077/EnvPathInjectionMedium.ql

+2-2
Original file line numberDiff line numberDiff line change
@@ -2,9 +2,9 @@
22
* @name PATH Enviroment Variable built from user-controlled sources
33
* @description Building the PATH environment variable from user-controlled sources may alter the execution of following system commands
44
* @kind path-problem
5-
* @problem.severity warning
5+
* @problem.severity error
66
* @security-severity 5.0
7-
* @precision high
7+
* @precision medium
88
* @id actions/envpath-injection/medium
99
* @tags actions
1010
* security

‎actions/ql/src/Security/CWE-077/EnvVarInjectionMedium.ql

+2-2
Original file line numberDiff line numberDiff line change
@@ -2,9 +2,9 @@
22
* @name Enviroment Variable built from user-controlled sources
33
* @description Building an environment variable from user-controlled sources may alter the execution of following system commands
44
* @kind path-problem
5-
* @problem.severity warning
5+
* @problem.severity error
66
* @security-severity 5.0
7-
* @precision high
7+
* @precision medium
88
* @id actions/envvar-injection/medium
99
* @tags actions
1010
* security

0 commit comments

Comments
 (0)