Skip to content

Commit 4ad7c1f

Browse files
author
Alvaro Muñoz
authored
Merge pull request #57 from github/workflow_run_branches
workflow run branches
2 parents 8231261 + 621ead2 commit 4ad7c1f

File tree

17 files changed

+186
-13
lines changed

17 files changed

+186
-13
lines changed

‎ql/lib/codeql/actions/Helper.qll

Lines changed: 8 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,6 @@
11
private import codeql.actions.Ast
22
private import codeql.Locations
3+
import codeql.actions.config.Config
34
private import codeql.actions.security.ControlChecks
45

56
bindingset[expr]
@@ -264,3 +265,10 @@ predicate outputsPartialFileContent(string snippet) {
264265
".*"
265266
])
266267
}
268+
269+
string defaultBranchNames() {
270+
repositoryDataModel(_, result)
271+
or
272+
not exists(string default_branch_name | repositoryDataModel(_, default_branch_name)) and
273+
result = ["main", "master"]
274+
}

‎ql/lib/codeql/actions/ast/internal/Ast.qll

Lines changed: 12 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -710,7 +710,18 @@ class EventImpl extends AstNodeImpl, TEventNode {
710710
/** Holds if the event can be triggered by an external actor. */
711711
predicate isExternallyTriggerable() {
712712
// the job is triggered by an event that can be triggered externally
713-
externallyTriggerableEventsDataModel(this.getName())
713+
// except for workflow_run which requires additional checks
714+
externallyTriggerableEventsDataModel(this.getName()) and
715+
not this.getName() = "workflow_run"
716+
or
717+
this.getName() = "workflow_run" and
718+
// workflow_run cannot be externally triggered if they triggering workflow runs in the context of the default branch
719+
// since an attacker can change the triggering workflow from any event to `pull_request` to trigger the workflow
720+
// but in that case, the triggering workflow will run in the context of the PR head branch
721+
(
722+
not exists(this.getAPropertyValue("branches")) or
723+
this.getAPropertyValue("branches").matches("%*%")
724+
)
714725
or
715726
// the event is `workflow_call` and there is a caller workflow that can be triggered externally
716727
this.getName() = "workflow_call" and

‎ql/lib/codeql/actions/security/CachePoisoningQuery.qll

Lines changed: 1 addition & 10 deletions
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,6 @@
11
import actions
22
import codeql.actions.config.Config
3+
import codeql.actions.Helper
34

45
string defaultBranchTriggerEvent() {
56
result =
@@ -11,16 +12,6 @@ string defaultBranchTriggerEvent() {
1112
]
1213
}
1314

14-
string defaultBranchNames() {
15-
exists(string default_branch_name |
16-
repositoryDataModel(_, default_branch_name) and
17-
result = default_branch_name
18-
)
19-
or
20-
not exists(string default_branch_name | repositoryDataModel(_, default_branch_name)) and
21-
result = ["main", "master"]
22-
}
23-
2415
predicate runsOnDefaultBranch(Event e) {
2516
(
2617
e.getName() = defaultBranchTriggerEvent() and

‎ql/lib/ext/manual/appleboy_ssh-action.model.yml

Lines changed: 8 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,8 @@
1+
extensions:
2+
- addsTo:
3+
pack: github/actions-all
4+
extensible: actionsSinkModel
5+
data:
6+
- ["appleboy/ssh-action", "*", "input.script", "code-injection", "manual"]
7+
- ["appleboy/ssh-action", "*", "input.envs", "envvar-injection", "manual"]
8+

‎ql/lib/qlpack.yml

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -2,7 +2,7 @@
22
library: true
33
warnOnImplicitThis: true
44
name: github/actions-all
5-
version: 0.1.15
5+
version: 0.1.16
66
dependencies:
77
codeql/util: ^1.0.1
88
codeql/yaml: ^1.0.1

‎ql/src/qlpack.yml

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,7 @@
11
---
22
library: false
33
name: github/actions-queries
4-
version: 0.1.15
4+
version: 0.1.16
55
groups: [actions, queries]
66
suites: codeql-suites
77
extractor: javascript

‎ql/test/query-tests/Security/CWE-094/.github/workflows/workflow_run_branches1.yml

Lines changed: 13 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,13 @@
1+
name: Self-hosted runner (AMD mi250 CI caller)
2+
3+
on:
4+
workflow_run:
5+
workflows: ["Test"]
6+
branches: ["main"]
7+
types: [completed]
8+
9+
jobs:
10+
test:
11+
runs-on: ubuntu-latest
12+
steps:
13+
- run: echo ${{ github.event.workflow_run.head_branch }}

‎ql/test/query-tests/Security/CWE-094/.github/workflows/workflow_run_branches2.yml

Lines changed: 13 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,13 @@
1+
name: Self-hosted runner (AMD mi250 CI caller)
2+
3+
on:
4+
workflow_run:
5+
workflows: ["Test"]
6+
branches: "main"
7+
types: [completed]
8+
9+
jobs:
10+
test:
11+
runs-on: ubuntu-latest
12+
steps:
13+
- run: echo ${{ github.event.workflow_run.head_branch }}

‎ql/test/query-tests/Security/CWE-094/.github/workflows/workflow_run_branches3.yml

Lines changed: 12 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,12 @@
1+
name: Self-hosted runner (AMD mi250 CI caller)
2+
3+
on:
4+
workflow_run:
5+
workflows: ["Test"]
6+
types: [completed]
7+
8+
jobs:
9+
test:
10+
runs-on: ubuntu-latest
11+
steps:
12+
- run: echo ${{ github.event.workflow_run.head_branch }}

‎ql/test/query-tests/Security/CWE-094/.github/workflows/workflow_run_branches4.yml

Lines changed: 13 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,13 @@
1+
name: Self-hosted runner (AMD mi250 CI caller)
2+
3+
on:
4+
workflow_run:
5+
workflows: ["Test"]
6+
branches: ["feat/**"]
7+
types: [completed]
8+
9+
jobs:
10+
test:
11+
runs-on: ubuntu-latest
12+
steps:
13+
- run: echo ${{ github.event.workflow_run.head_branch }}

‎ql/test/query-tests/Security/CWE-094/CodeInjectionCritical.expected

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -295,6 +295,10 @@ nodes
295295
| .github/workflows/workflow_run.yml:14:19:14:77 | github.event.workflow_run.head_commit.committer.name | semmle.label | github.event.workflow_run.head_commit.committer.name |
296296
| .github/workflows/workflow_run.yml:15:19:15:62 | github.event.workflow_run.head_branch | semmle.label | github.event.workflow_run.head_branch |
297297
| .github/workflows/workflow_run.yml:16:19:16:78 | github.event.workflow_run.head_repository.description | semmle.label | github.event.workflow_run.head_repository.description |
298+
| .github/workflows/workflow_run_branches1.yml:13:20:13:63 | github.event.workflow_run.head_branch | semmle.label | github.event.workflow_run.head_branch |
299+
| .github/workflows/workflow_run_branches2.yml:13:20:13:63 | github.event.workflow_run.head_branch | semmle.label | github.event.workflow_run.head_branch |
300+
| .github/workflows/workflow_run_branches3.yml:12:20:12:63 | github.event.workflow_run.head_branch | semmle.label | github.event.workflow_run.head_branch |
301+
| .github/workflows/workflow_run_branches4.yml:13:20:13:63 | github.event.workflow_run.head_branch | semmle.label | github.event.workflow_run.head_branch |
298302
subpaths
299303
#select
300304
| .github/actions/action1/action.yml:7:19:7:55 | github.event.pull_request.body | .github/actions/action1/action.yml:7:19:7:55 | github.event.pull_request.body | .github/actions/action1/action.yml:7:19:7:55 | github.event.pull_request.body | Potential code injection in $@, which may be controlled by an external user. | .github/actions/action1/action.yml:7:19:7:55 | github.event.pull_request.body | ${{ github.event.pull_request.body }} |
@@ -388,3 +392,5 @@ subpaths
388392
| .github/workflows/workflow_run.yml:14:19:14:77 | github.event.workflow_run.head_commit.committer.name | .github/workflows/workflow_run.yml:14:19:14:77 | github.event.workflow_run.head_commit.committer.name | .github/workflows/workflow_run.yml:14:19:14:77 | github.event.workflow_run.head_commit.committer.name | Potential code injection in $@, which may be controlled by an external user. | .github/workflows/workflow_run.yml:14:19:14:77 | github.event.workflow_run.head_commit.committer.name | ${{ github.event.workflow_run.head_commit.committer.name }} |
389393
| .github/workflows/workflow_run.yml:15:19:15:62 | github.event.workflow_run.head_branch | .github/workflows/workflow_run.yml:15:19:15:62 | github.event.workflow_run.head_branch | .github/workflows/workflow_run.yml:15:19:15:62 | github.event.workflow_run.head_branch | Potential code injection in $@, which may be controlled by an external user. | .github/workflows/workflow_run.yml:15:19:15:62 | github.event.workflow_run.head_branch | ${{ github.event.workflow_run.head_branch }} |
390394
| .github/workflows/workflow_run.yml:16:19:16:78 | github.event.workflow_run.head_repository.description | .github/workflows/workflow_run.yml:16:19:16:78 | github.event.workflow_run.head_repository.description | .github/workflows/workflow_run.yml:16:19:16:78 | github.event.workflow_run.head_repository.description | Potential code injection in $@, which may be controlled by an external user. | .github/workflows/workflow_run.yml:16:19:16:78 | github.event.workflow_run.head_repository.description | ${{ github.event.workflow_run.head_repository.description }} |
395+
| .github/workflows/workflow_run_branches3.yml:12:20:12:63 | github.event.workflow_run.head_branch | .github/workflows/workflow_run_branches3.yml:12:20:12:63 | github.event.workflow_run.head_branch | .github/workflows/workflow_run_branches3.yml:12:20:12:63 | github.event.workflow_run.head_branch | Potential code injection in $@, which may be controlled by an external user. | .github/workflows/workflow_run_branches3.yml:12:20:12:63 | github.event.workflow_run.head_branch | ${{ github.event.workflow_run.head_branch }} |
396+
| .github/workflows/workflow_run_branches4.yml:13:20:13:63 | github.event.workflow_run.head_branch | .github/workflows/workflow_run_branches4.yml:13:20:13:63 | github.event.workflow_run.head_branch | .github/workflows/workflow_run_branches4.yml:13:20:13:63 | github.event.workflow_run.head_branch | Potential code injection in $@, which may be controlled by an external user. | .github/workflows/workflow_run_branches4.yml:13:20:13:63 | github.event.workflow_run.head_branch | ${{ github.event.workflow_run.head_branch }} |

‎ql/test/query-tests/Security/CWE-094/CodeInjectionMedium.expected

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -295,6 +295,10 @@ nodes
295295
| .github/workflows/workflow_run.yml:14:19:14:77 | github.event.workflow_run.head_commit.committer.name | semmle.label | github.event.workflow_run.head_commit.committer.name |
296296
| .github/workflows/workflow_run.yml:15:19:15:62 | github.event.workflow_run.head_branch | semmle.label | github.event.workflow_run.head_branch |
297297
| .github/workflows/workflow_run.yml:16:19:16:78 | github.event.workflow_run.head_repository.description | semmle.label | github.event.workflow_run.head_repository.description |
298+
| .github/workflows/workflow_run_branches1.yml:13:20:13:63 | github.event.workflow_run.head_branch | semmle.label | github.event.workflow_run.head_branch |
299+
| .github/workflows/workflow_run_branches2.yml:13:20:13:63 | github.event.workflow_run.head_branch | semmle.label | github.event.workflow_run.head_branch |
300+
| .github/workflows/workflow_run_branches3.yml:12:20:12:63 | github.event.workflow_run.head_branch | semmle.label | github.event.workflow_run.head_branch |
301+
| .github/workflows/workflow_run_branches4.yml:13:20:13:63 | github.event.workflow_run.head_branch | semmle.label | github.event.workflow_run.head_branch |
298302
subpaths
299303
#select
300304
| .github/actions/action3/action.yml:9:19:9:55 | github.event.pull_request.body | .github/actions/action3/action.yml:9:19:9:55 | github.event.pull_request.body | .github/actions/action3/action.yml:9:19:9:55 | github.event.pull_request.body | Potential code injection in $@, which may be controlled by an external user. | .github/actions/action3/action.yml:9:19:9:55 | github.event.pull_request.body | ${{ github.event.pull_request.body }} |
@@ -325,3 +329,5 @@ subpaths
325329
| .github/workflows/push.yml:16:19:16:64 | github.event.commits[11].committer.name | .github/workflows/push.yml:16:19:16:64 | github.event.commits[11].committer.name | .github/workflows/push.yml:16:19:16:64 | github.event.commits[11].committer.name | Potential code injection in $@, which may be controlled by an external user. | .github/workflows/push.yml:16:19:16:64 | github.event.commits[11].committer.name | ${{ github.event.commits[11].committer.name }} |
326330
| .github/workflows/simple1.yml:16:18:16:49 | steps.summary.outputs.value | .github/workflows/simple1.yml:11:20:11:58 | github.event.head_commit.message | .github/workflows/simple1.yml:16:18:16:49 | steps.summary.outputs.value | Potential code injection in $@, which may be controlled by an external user. | .github/workflows/simple1.yml:16:18:16:49 | steps.summary.outputs.value | ${{steps.summary.outputs.value}} |
327331
| .github/workflows/test.yml:49:20:49:56 | needs.job1.outputs['job_output'] | .github/workflows/test.yml:15:20:15:64 | github.event['head_commit']['message'] | .github/workflows/test.yml:49:20:49:56 | needs.job1.outputs['job_output'] | Potential code injection in $@, which may be controlled by an external user. | .github/workflows/test.yml:49:20:49:56 | needs.job1.outputs['job_output'] | ${{needs.job1.outputs['job_output']}} |
332+
| .github/workflows/workflow_run_branches1.yml:13:20:13:63 | github.event.workflow_run.head_branch | .github/workflows/workflow_run_branches1.yml:13:20:13:63 | github.event.workflow_run.head_branch | .github/workflows/workflow_run_branches1.yml:13:20:13:63 | github.event.workflow_run.head_branch | Potential code injection in $@, which may be controlled by an external user. | .github/workflows/workflow_run_branches1.yml:13:20:13:63 | github.event.workflow_run.head_branch | ${{ github.event.workflow_run.head_branch }} |
333+
| .github/workflows/workflow_run_branches2.yml:13:20:13:63 | github.event.workflow_run.head_branch | .github/workflows/workflow_run_branches2.yml:13:20:13:63 | github.event.workflow_run.head_branch | .github/workflows/workflow_run_branches2.yml:13:20:13:63 | github.event.workflow_run.head_branch | Potential code injection in $@, which may be controlled by an external user. | .github/workflows/workflow_run_branches2.yml:13:20:13:63 | github.event.workflow_run.head_branch | ${{ github.event.workflow_run.head_branch }} |

‎ql/test/query-tests/Security/CWE-349/.github/workflows/test21.yml

Lines changed: 44 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,44 @@
1+
name: OpenAPI
2+
on:
3+
push:
4+
branches:
5+
- master
6+
tags:
7+
- 'v*'
8+
pull_request_target:
9+
10+
permissions: {}
11+
12+
jobs:
13+
14+
openapi-base:
15+
name: OpenAPI - BASE
16+
if: ${{ github.base_ref != '' }}
17+
runs-on: ubuntu-latest
18+
permissions: read-all
19+
steps:
20+
- name: Checkout repository
21+
uses: actions/checkout@a5ac7e51b41094c92402da3b24376905380afc29 # v4.1.6
22+
with:
23+
ref: ${{ github.event.pull_request.head.sha }}
24+
repository: ${{ github.event.pull_request.head.repo.full_name }}
25+
fetch-depth: 0
26+
- name: Generate openapi.json
27+
run: dotnet test tests/Jellyfin.Server.Integration.Tests/Jellyfin.Server.Integration.Tests.csproj -c Release --filter "Jellyfin.Server.Integration.Tests.OpenApiSpecTests"
28+
29+
publish-unstable:
30+
name: OpenAPI - Publish Unstable Spec
31+
if: ${{ github.event_name != 'pull_request_target' && !startsWith(github.ref, 'refs/tags/v') && contains(github.repository_owner, 'jellyfin') }}
32+
runs-on: ubuntu-latest
33+
needs:
34+
- openapi-base
35+
steps:
36+
- name: Upload openapi.json (unstable) to repository server
37+
uses: appleboy/scp-action@917f8b81dfc1ccd331fef9e2d61bdc6c8be94634 # v0.1.7
38+
with:
39+
host: "${{ secrets.REPO_HOST }}"
40+
username: "${{ secrets.REPO_USER }}"
41+
key: "${{ secrets.REPO_KEY }}"
42+
source: openapi-head/openapi.json
43+
strip_components: 1
44+
target: "/srv/incoming/openapi/unstable/jellyfin-openapi-${{ env.JELLYFIN_VERSION }}"

‎ql/test/query-tests/Security/CWE-349/CachePoisoning.expected

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -155,6 +155,7 @@ edges
155155
| .github/workflows/test20.yml:41:7:42:4 | Run Step | .github/workflows/test20.yml:42:7:43:4 | Run Step |
156156
| .github/workflows/test20.yml:41:7:42:4 | Run Step | .github/workflows/test20.yml:43:7:46:39 | Uses Step |
157157
| .github/workflows/test20.yml:42:7:43:4 | Run Step | .github/workflows/test20.yml:43:7:46:39 | Uses Step |
158+
| .github/workflows/test21.yml:20:9:26:6 | Uses Step | .github/workflows/test21.yml:26:9:29:2 | Run Step |
158159
#select
159160
| .github/workflows/poc3.yml:33:7:38:4 | Uses Step | .github/workflows/poc3.yml:18:7:25:4 | Uses Step | .github/workflows/poc3.yml:33:7:38:4 | Uses Step | Potential cache poisoning in the context of the default branch |
160161
| .github/workflows/poc3.yml:38:7:40:4 | Run Step | .github/workflows/poc3.yml:18:7:25:4 | Uses Step | .github/workflows/poc3.yml:38:7:40:4 | Run Step | Potential cache poisoning in the context of the default branch |
@@ -177,3 +178,4 @@ edges
177178
| .github/workflows/test20.yml:38:7:40:4 | Run Step | .github/workflows/test20.yml:18:7:25:4 | Uses Step | .github/workflows/test20.yml:38:7:40:4 | Run Step | Potential cache poisoning in the context of the default branch |
178179
| .github/workflows/test20.yml:41:7:42:4 | Run Step | .github/workflows/test20.yml:18:7:25:4 | Uses Step | .github/workflows/test20.yml:41:7:42:4 | Run Step | Potential cache poisoning in the context of the default branch |
179180
| .github/workflows/test20.yml:42:7:43:4 | Run Step | .github/workflows/test20.yml:18:7:25:4 | Uses Step | .github/workflows/test20.yml:42:7:43:4 | Run Step | Potential cache poisoning in the context of the default branch |
181+
| .github/workflows/test21.yml:26:9:29:2 | Run Step | .github/workflows/test21.yml:20:9:26:6 | Uses Step | .github/workflows/test21.yml:26:9:29:2 | Run Step | Potential cache poisoning in the context of the default branch |

‎ql/test/query-tests/Security/CWE-829/.github/workflows/test8.yml

Lines changed: 44 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,44 @@
1+
name: OpenAPI
2+
on:
3+
push:
4+
branches:
5+
- master
6+
tags:
7+
- 'v*'
8+
pull_request_target:
9+
10+
permissions: {}
11+
12+
jobs:
13+
14+
openapi-base:
15+
name: OpenAPI - BASE
16+
if: ${{ github.base_ref != '' }}
17+
runs-on: ubuntu-latest
18+
permissions: read-all
19+
steps:
20+
- name: Checkout repository
21+
uses: actions/checkout@a5ac7e51b41094c92402da3b24376905380afc29 # v4.1.6
22+
with:
23+
ref: ${{ github.event.pull_request.head.sha }}
24+
repository: ${{ github.event.pull_request.head.repo.full_name }}
25+
fetch-depth: 0
26+
- name: Generate openapi.json
27+
run: dotnet test tests/Jellyfin.Server.Integration.Tests/Jellyfin.Server.Integration.Tests.csproj -c Release --filter "Jellyfin.Server.Integration.Tests.OpenApiSpecTests"
28+
29+
publish-unstable:
30+
name: OpenAPI - Publish Unstable Spec
31+
if: ${{ github.event_name != 'pull_request_target' && !startsWith(github.ref, 'refs/tags/v') && contains(github.repository_owner, 'jellyfin') }}
32+
runs-on: ubuntu-latest
33+
needs:
34+
- openapi-base
35+
steps:
36+
- name: Upload openapi.json (unstable) to repository server
37+
uses: appleboy/scp-action@917f8b81dfc1ccd331fef9e2d61bdc6c8be94634 # v0.1.7
38+
with:
39+
host: "${{ secrets.REPO_HOST }}"
40+
username: "${{ secrets.REPO_USER }}"
41+
key: "${{ secrets.REPO_KEY }}"
42+
source: openapi-head/openapi.json
43+
strip_components: 1
44+
target: "/srv/incoming/openapi/unstable/jellyfin-openapi-${{ env.JELLYFIN_VERSION }}"

‎ql/test/query-tests/Security/CWE-829/UntrustedCheckoutCritical.expected

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -325,6 +325,7 @@ edges
325325
| .github/workflows/test7.yml:36:9:39:6 | Run Step | .github/workflows/test7.yml:39:9:49:6 | Run Step: bench-command |
326326
| .github/workflows/test7.yml:36:9:39:6 | Run Step | .github/workflows/test7.yml:49:9:58:20 | Run Step: benchmark-pr |
327327
| .github/workflows/test7.yml:39:9:49:6 | Run Step: bench-command | .github/workflows/test7.yml:49:9:58:20 | Run Step: benchmark-pr |
328+
| .github/workflows/test8.yml:20:9:26:6 | Uses Step | .github/workflows/test8.yml:26:9:29:2 | Run Step |
328329
| .github/workflows/test.yml:13:9:14:6 | Uses Step | .github/workflows/test.yml:14:9:25:6 | Run Step |
329330
| .github/workflows/test.yml:13:9:14:6 | Uses Step | .github/workflows/test.yml:25:9:33:6 | Run Step |
330331
| .github/workflows/test.yml:13:9:14:6 | Uses Step | .github/workflows/test.yml:33:9:37:34 | Run Step |

‎ql/test/query-tests/Security/CWE-829/UntrustedCheckoutMedium.expected

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -6,3 +6,4 @@
66
| .github/workflows/priv_pull_request_checkout.yml:14:9:20:6 | Uses Step | Potential unsafe checkout of untrusted pull request on privileged workflow. |
77
| .github/workflows/test3.yml:28:9:33:6 | Uses Step | Potential unsafe checkout of untrusted pull request on privileged workflow. |
88
| .github/workflows/test4.yml:18:7:25:4 | Uses Step | Potential unsafe checkout of untrusted pull request on privileged workflow. |
9+
| .github/workflows/test8.yml:20:9:26:6 | Uses Step | Potential unsafe checkout of untrusted pull request on privileged workflow. |

0 commit comments

Comments
 (0)