Skip to content

Commit 6466a5d

Browse files
MathiasVPMathiasVP
committed
Merge branch 'main' into add-missing-predicate-to-mad-generation
2 parents 79c0310 + 8857f0d commit 6466a5d

File tree

198 files changed

+14220
-867
lines changed

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

198 files changed

+14220
-867
lines changed

‎actions/ql/integration-tests/query-suite/actions-code-quality.qls.expected

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1 @@
1+

‎actions/ql/integration-tests/query-suite/actions-code-scanning.qls.expected

Lines changed: 17 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,17 @@
1+
ql/actions/ql/src/Security/CWE-077/EnvPathInjectionCritical.ql
2+
ql/actions/ql/src/Security/CWE-077/EnvVarInjectionCritical.ql
3+
ql/actions/ql/src/Security/CWE-094/CodeInjectionCritical.ql
4+
ql/actions/ql/src/Security/CWE-1395/UseOfKnownVulnerableAction.ql
5+
ql/actions/ql/src/Security/CWE-275/MissingActionsPermissions.ql
6+
ql/actions/ql/src/Security/CWE-285/ImproperAccessControl.ql
7+
ql/actions/ql/src/Security/CWE-312/ExcessiveSecretsExposure.ql
8+
ql/actions/ql/src/Security/CWE-312/SecretsInArtifacts.ql
9+
ql/actions/ql/src/Security/CWE-312/UnmaskedSecretExposure.ql
10+
ql/actions/ql/src/Security/CWE-349/CachePoisoningViaCodeInjection.ql
11+
ql/actions/ql/src/Security/CWE-349/CachePoisoningViaDirectCache.ql
12+
ql/actions/ql/src/Security/CWE-349/CachePoisoningViaPoisonableStep.ql
13+
ql/actions/ql/src/Security/CWE-367/UntrustedCheckoutTOCTOUCritical.ql
14+
ql/actions/ql/src/Security/CWE-367/UntrustedCheckoutTOCTOUHigh.ql
15+
ql/actions/ql/src/Security/CWE-829/ArtifactPoisoningCritical.ql
16+
ql/actions/ql/src/Security/CWE-829/UntrustedCheckoutCritical.ql
17+
ql/actions/ql/src/Security/CWE-829/UntrustedCheckoutHigh.ql

‎actions/ql/integration-tests/query-suite/actions-security-and-quality.qls.expected

Lines changed: 33 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,33 @@
1+
ql/actions/ql/src/Debug/SyntaxError.ql
2+
ql/actions/ql/src/Models/CompositeActionsSinks.ql
3+
ql/actions/ql/src/Models/CompositeActionsSources.ql
4+
ql/actions/ql/src/Models/CompositeActionsSummaries.ql
5+
ql/actions/ql/src/Models/ReusableWorkflowsSinks.ql
6+
ql/actions/ql/src/Models/ReusableWorkflowsSources.ql
7+
ql/actions/ql/src/Models/ReusableWorkflowsSummaries.ql
8+
ql/actions/ql/src/Security/CWE-077/EnvPathInjectionCritical.ql
9+
ql/actions/ql/src/Security/CWE-077/EnvPathInjectionMedium.ql
10+
ql/actions/ql/src/Security/CWE-077/EnvVarInjectionCritical.ql
11+
ql/actions/ql/src/Security/CWE-077/EnvVarInjectionMedium.ql
12+
ql/actions/ql/src/Security/CWE-094/CodeInjectionCritical.ql
13+
ql/actions/ql/src/Security/CWE-094/CodeInjectionMedium.ql
14+
ql/actions/ql/src/Security/CWE-1395/UseOfKnownVulnerableAction.ql
15+
ql/actions/ql/src/Security/CWE-275/MissingActionsPermissions.ql
16+
ql/actions/ql/src/Security/CWE-285/ImproperAccessControl.ql
17+
ql/actions/ql/src/Security/CWE-312/ExcessiveSecretsExposure.ql
18+
ql/actions/ql/src/Security/CWE-312/SecretsInArtifacts.ql
19+
ql/actions/ql/src/Security/CWE-312/UnmaskedSecretExposure.ql
20+
ql/actions/ql/src/Security/CWE-349/CachePoisoningViaCodeInjection.ql
21+
ql/actions/ql/src/Security/CWE-349/CachePoisoningViaDirectCache.ql
22+
ql/actions/ql/src/Security/CWE-349/CachePoisoningViaPoisonableStep.ql
23+
ql/actions/ql/src/Security/CWE-367/UntrustedCheckoutTOCTOUCritical.ql
24+
ql/actions/ql/src/Security/CWE-367/UntrustedCheckoutTOCTOUHigh.ql
25+
ql/actions/ql/src/Security/CWE-571/ExpressionIsAlwaysTrueCritical.ql
26+
ql/actions/ql/src/Security/CWE-571/ExpressionIsAlwaysTrueHigh.ql
27+
ql/actions/ql/src/Security/CWE-829/ArtifactPoisoningCritical.ql
28+
ql/actions/ql/src/Security/CWE-829/ArtifactPoisoningMedium.ql
29+
ql/actions/ql/src/Security/CWE-829/UnpinnedActionsTag.ql
30+
ql/actions/ql/src/Security/CWE-829/UntrustedCheckoutCritical.ql
31+
ql/actions/ql/src/Security/CWE-829/UntrustedCheckoutHigh.ql
32+
ql/actions/ql/src/Security/CWE-829/UntrustedCheckoutMedium.ql
33+
ql/actions/ql/src/Violations Of Best Practice/CodeQL/UnnecessaryUseOfAdvancedConfig.ql

‎actions/ql/integration-tests/query-suite/actions-security-extended.qls.expected

Lines changed: 23 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,23 @@
1+
ql/actions/ql/src/Security/CWE-077/EnvPathInjectionCritical.ql
2+
ql/actions/ql/src/Security/CWE-077/EnvPathInjectionMedium.ql
3+
ql/actions/ql/src/Security/CWE-077/EnvVarInjectionCritical.ql
4+
ql/actions/ql/src/Security/CWE-077/EnvVarInjectionMedium.ql
5+
ql/actions/ql/src/Security/CWE-094/CodeInjectionCritical.ql
6+
ql/actions/ql/src/Security/CWE-094/CodeInjectionMedium.ql
7+
ql/actions/ql/src/Security/CWE-1395/UseOfKnownVulnerableAction.ql
8+
ql/actions/ql/src/Security/CWE-275/MissingActionsPermissions.ql
9+
ql/actions/ql/src/Security/CWE-285/ImproperAccessControl.ql
10+
ql/actions/ql/src/Security/CWE-312/ExcessiveSecretsExposure.ql
11+
ql/actions/ql/src/Security/CWE-312/SecretsInArtifacts.ql
12+
ql/actions/ql/src/Security/CWE-312/UnmaskedSecretExposure.ql
13+
ql/actions/ql/src/Security/CWE-349/CachePoisoningViaCodeInjection.ql
14+
ql/actions/ql/src/Security/CWE-349/CachePoisoningViaDirectCache.ql
15+
ql/actions/ql/src/Security/CWE-349/CachePoisoningViaPoisonableStep.ql
16+
ql/actions/ql/src/Security/CWE-367/UntrustedCheckoutTOCTOUCritical.ql
17+
ql/actions/ql/src/Security/CWE-367/UntrustedCheckoutTOCTOUHigh.ql
18+
ql/actions/ql/src/Security/CWE-829/ArtifactPoisoningCritical.ql
19+
ql/actions/ql/src/Security/CWE-829/ArtifactPoisoningMedium.ql
20+
ql/actions/ql/src/Security/CWE-829/UnpinnedActionsTag.ql
21+
ql/actions/ql/src/Security/CWE-829/UntrustedCheckoutCritical.ql
22+
ql/actions/ql/src/Security/CWE-829/UntrustedCheckoutHigh.ql
23+
ql/actions/ql/src/Security/CWE-829/UntrustedCheckoutMedium.ql

‎actions/ql/integration-tests/query-suite/not_included_in_qls.expected

Lines changed: 11 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,11 @@
1+
ql/actions/ql/src/Debug/partial.ql
2+
ql/actions/ql/src/experimental/Security/CWE-074/OutputClobberingHigh.ql
3+
ql/actions/ql/src/experimental/Security/CWE-078/CommandInjectionCritical.ql
4+
ql/actions/ql/src/experimental/Security/CWE-078/CommandInjectionMedium.ql
5+
ql/actions/ql/src/experimental/Security/CWE-088/ArgumentInjectionCritical.ql
6+
ql/actions/ql/src/experimental/Security/CWE-088/ArgumentInjectionMedium.ql
7+
ql/actions/ql/src/experimental/Security/CWE-200/SecretExfiltration.ql
8+
ql/actions/ql/src/experimental/Security/CWE-284/CodeExecutionOnSelfHostedRunner.ql
9+
ql/actions/ql/src/experimental/Security/CWE-829/ArtifactPoisoningPathTraversal.ql
10+
ql/actions/ql/src/experimental/Security/CWE-829/UnversionedImmutableAction.ql
11+
ql/actions/ql/src/experimental/Security/CWE-918/RequestForgery.ql

‎actions/ql/integration-tests/query-suite/test.py

Lines changed: 14 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,14 @@
1+
import runs_on
2+
import pytest
3+
from query_suites import *
4+
5+
well_known_query_suites = ['actions-code-quality.qls', 'actions-security-and-quality.qls', 'actions-security-extended.qls', 'actions-code-scanning.qls']
6+
7+
@runs_on.posix
8+
@pytest.mark.parametrize("query_suite", well_known_query_suites)
9+
def test(codeql, actions, check_query_suite, query_suite):
10+
check_query_suite(query_suite)
11+
12+
@runs_on.posix
13+
def test_not_included_queries(codeql, actions, check_queries_not_included):
14+
check_queries_not_included('actions', well_known_query_suites)

‎actions/ql/src/Models/ReusableWorkflowsSinks.ql

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -5,7 +5,7 @@
55
* @problem.severity warning
66
* @security-severity 9.3
77
* @precision high
8-
* @id actions/reusable-wokflow-sinks
8+
* @id actions/reusable-workflow-sinks
99
* @tags actions
1010
* model-generator
1111
* external/cwe/cwe-020

‎actions/ql/src/change-notes/2025-04-24-model-generator-queries.md

Lines changed: 14 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,14 @@
1+
### Breaking Changes
2+
3+
* The following queries have been removed from the `security-and-quality` suite.
4+
They are not intended to produce user-facing
5+
alerts describing vulnerabilities.
6+
Any existing alerts for these queries will be closed automatically.
7+
* `actions/composite-action-sinks`
8+
* `actions/composite-action-sources`
9+
* `actions/composite-action-summaries`
10+
* `actions/reusable-workflow-sinks`
11+
(renamed from `actions/reusable-wokflow-sinks`)
12+
* `actions/reusable-workflow-sources`
13+
* `actions/reusable-workflow-summaries`
14+

‎cpp/ql/src/Likely Bugs/Arithmetic/IntMultToLong.ql

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -179,6 +179,7 @@ predicate overflows(MulExpr me, Type t) {
179179

180180
from MulExpr me, Type t1, Type t2
181181
where
182+
not any(Compilation c).buildModeNone() and
182183
t1 = me.getType().getUnderlyingType() and
183184
t2 = me.getConversion().getType().getUnderlyingType() and
184185
t1.getSize() < t2.getSize() and

‎cpp/ql/src/Likely Bugs/Format/WrongTypeFormatArguments.ql

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -154,6 +154,7 @@ int sizeof_IntType() { exists(IntType it | result = it.getSize()) }
154154

155155
from FormattingFunctionCall ffc, int n, Expr arg, Type expected, Type actual
156156
where
157+
not any(Compilation c).buildModeNone() and
157158
(
158159
formattingFunctionCallExpectedType(ffc, n, expected) and
159160
formattingFunctionCallActualType(ffc, n, arg, actual) and

‎cpp/ql/src/Likely Bugs/Underspecified Functions/ImplicitFunctionDeclaration.ql

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -38,6 +38,7 @@ predicate isCompiledAsC(File f) {
3838

3939
from FunctionDeclarationEntry fdeIm, FunctionCall fc
4040
where
41+
not any(Compilation c).buildModeNone() and
4142
isCompiledAsC(fdeIm.getFile()) and
4243
not isFromMacroDefinition(fc) and
4344
fdeIm.isImplicit() and

‎cpp/ql/src/Security/CWE/CWE-190/ComparisonWithWiderType.ql

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -51,6 +51,7 @@ int getComparisonSizeAdjustment(Expr e) {
5151

5252
from Loop l, RelationalOperation rel, VariableAccess small, Expr large
5353
where
54+
not any(Compilation c).buildModeNone() and
5455
small = rel.getLesserOperand() and
5556
large = rel.getGreaterOperand() and
5657
rel = l.getCondition().getAChild*() and

‎cpp/ql/src/Security/CWE/CWE-468/SuspiciousAddWithSizeof.ql

Lines changed: 3 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -24,10 +24,12 @@ private predicate isCharSzPtrExpr(Expr e) {
2424

2525
from Expr sizeofExpr, Expr e
2626
where
27+
not any(Compilation c).buildModeNone() and
2728
// If we see an addWithSizeof then we expect the type of
2829
// the pointer expression to be `char*` or `void*`. Otherwise it
2930
// is probably a mistake.
30-
addWithSizeof(e, sizeofExpr, _) and not isCharSzPtrExpr(e)
31+
addWithSizeof(e, sizeofExpr, _) and
32+
not isCharSzPtrExpr(e)
3133
select sizeofExpr,
3234
"Suspicious sizeof offset in a pointer arithmetic expression. The type of the pointer is $@.",
3335
e.getFullyConverted().getType() as t, t.toString()

‎cpp/ql/src/utils/modelgenerator/CaptureMixedNeutralModels.ql

Lines changed: 0 additions & 13 deletions
This file was deleted.

‎cpp/ql/src/utils/modelgenerator/CaptureMixedSummaryModels.ql

Lines changed: 0 additions & 13 deletions
This file was deleted.

‎cpp/ql/src/utils/modelgenerator/CaptureNeutralModels.ql

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -9,5 +9,5 @@
99
import internal.CaptureModels
1010

1111
from DataFlowSummaryTargetApi api, string noflow
12-
where noflow = captureNoFlow(api)
12+
where noflow = captureNeutral(api)
1313
select noflow order by noflow

‎cpp/ql/src/utils/modelgenerator/CaptureSinkModels.ql

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -7,6 +7,7 @@
77
*/
88

99
import internal.CaptureModels
10+
import Heuristic
1011

1112
from DataFlowSinkTargetApi api, string sink
1213
where sink = captureSink(api)

‎cpp/ql/src/utils/modelgenerator/CaptureSourceModels.ql

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -7,6 +7,7 @@
77
*/
88

99
import internal.CaptureModels
10+
import Heuristic
1011

1112
from DataFlowSourceTargetApi api, string source
1213
where source = captureSource(api)

‎cpp/ql/src/utils/modelgenerator/CaptureSummaryModels.ql

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -9,5 +9,5 @@
99
import internal.CaptureModels
1010

1111
from DataFlowSummaryTargetApi api, string flow
12-
where flow = captureFlow(api)
12+
where flow = captureFlow(api, _)
1313
select flow order by flow

‎cpp/ql/test/library-tests/dataflow/modelgenerator/dataflow/CaptureSummaryModels.expected renamed to ‎cpp/ql/test/library-tests/dataflow/modelgenerator/dataflow/CaptureHeuristicSummaryModels.expected

File renamed without changes.

‎cpp/ql/test/library-tests/dataflow/modelgenerator/dataflow/CaptureSummaryModels.ext.yml renamed to ‎cpp/ql/test/library-tests/dataflow/modelgenerator/dataflow/CaptureHeuristicSummaryModels.ext.yml

File renamed without changes.

‎cpp/ql/test/library-tests/dataflow/modelgenerator/dataflow/CaptureSummaryModels.ql renamed to ‎cpp/ql/test/library-tests/dataflow/modelgenerator/dataflow/CaptureHeuristicSummaryModels.ql

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -3,9 +3,9 @@ import utils.modelgenerator.internal.CaptureModels
33
import InlineModelsAsDataTest
44

55
module InlineMadTestConfig implements InlineMadTestConfigSig {
6-
string getCapturedModel(MadRelevantFunction c) { result = captureFlow(c) }
6+
string getCapturedModel(MadRelevantFunction c) { result = Heuristic::captureFlow(c) }
77

8-
string getKind() { result = "summary" }
8+
string getKind() { result = "heuristic-summary" }
99
}
1010

1111
import InlineMadTest<InlineMadTestConfig>

0 commit comments

Comments
 (0)