Skip to content

Commit 99e92af

Browse files
author
Alvaro Muñoz
committed
Update tests
1 parent 1e749ae commit 99e92af

38 files changed

+544
-280
lines changed

‎ql/test/library-tests/poisonable_steps.expected

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1,3 +1,5 @@
1+
| .github/workflows/multiline2.yml:63:9:66:6 | Run Step |
2+
| .github/workflows/multiline.yml:63:9:66:6 | Run Step |
13
| .github/workflows/poisonable_steps.yml:8:9:13:6 | Uses Step |
24
| .github/workflows/poisonable_steps.yml:13:9:14:6 | Run Step |
35
| .github/workflows/poisonable_steps.yml:14:9:15:6 | Run Step |

‎ql/test/library-tests/test.ql

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -150,6 +150,6 @@ query predicate isBashParameterExpansion(string parameter, string operator, stri
150150
"${parameter21%%pattern}", "${parameter22/pattern/string}",
151151
"${parameter23//pattern/string}",
152152
] and
153-
Bash::isBashParameterExpansion(test, parameter, operator, params)
153+
Bash::isParameterExpansion(test, parameter, operator, params)
154154
)
155155
}

‎ql/test/query-tests/Security/CWE-020/.github/workflows/calling_composite.yml renamed to ‎ql/test/query-tests/Models/.github/workflows/calling_composite.yml

File renamed without changes.

‎ql/test/query-tests/Security/CWE-020/.github/workflows/calling_workflow.yml renamed to ‎ql/test/query-tests/Models/.github/workflows/calling_workflow.yml

File renamed without changes.

‎ql/test/query-tests/Security/CWE-020/.github/workflows/reusable_workflow.yml renamed to ‎ql/test/query-tests/Models/.github/workflows/reusable_workflow.yml

File renamed without changes.

‎ql/test/query-tests/Security/CWE-020/CompositeActionsSinks.expected renamed to ‎ql/test/query-tests/Models/CompositeActionsSinks.expected

File renamed without changes.

‎ql/test/query-tests/Security/CWE-020/CompositeActionsSinks.qlref renamed to ‎ql/test/query-tests/Models/CompositeActionsSinks.qlref

File renamed without changes.

‎ql/test/query-tests/Security/CWE-020/CompositeActionsSources.expected renamed to ‎ql/test/query-tests/Models/CompositeActionsSources.expected

File renamed without changes.

‎ql/test/query-tests/Security/CWE-020/CompositeActionsSources.qlref renamed to ‎ql/test/query-tests/Models/CompositeActionsSources.qlref

File renamed without changes.

‎ql/test/query-tests/Security/CWE-020/CompositeActionsSummaries.expected renamed to ‎ql/test/query-tests/Models/CompositeActionsSummaries.expected

File renamed without changes.

‎ql/test/query-tests/Security/CWE-020/CompositeActionsSummaries.qlref renamed to ‎ql/test/query-tests/Models/CompositeActionsSummaries.qlref

File renamed without changes.

‎ql/test/query-tests/Security/CWE-020/ReusableWorkflowsSinks.expected renamed to ‎ql/test/query-tests/Models/ReusableWorkflowsSinks.expected

File renamed without changes.

‎ql/test/query-tests/Security/CWE-020/ReusableWorkflowsSinks.qlref renamed to ‎ql/test/query-tests/Models/ReusableWorkflowsSinks.qlref

File renamed without changes.

‎ql/test/query-tests/Security/CWE-020/ReusableWorkflowsSources.expected renamed to ‎ql/test/query-tests/Models/ReusableWorkflowsSources.expected

File renamed without changes.

‎ql/test/query-tests/Security/CWE-020/ReusableWorkflowsSources.qlref renamed to ‎ql/test/query-tests/Models/ReusableWorkflowsSources.qlref

File renamed without changes.

‎ql/test/query-tests/Security/CWE-020/ReusableWorkflowsSummaries.expected renamed to ‎ql/test/query-tests/Models/ReusableWorkflowsSummaries.expected

File renamed without changes.

‎ql/test/query-tests/Security/CWE-020/ReusableWorkflowsSummaries.qlref renamed to ‎ql/test/query-tests/Models/ReusableWorkflowsSummaries.qlref

File renamed without changes.

‎ql/test/query-tests/Security/CWE-020/action1/action.yml renamed to ‎ql/test/query-tests/Models/action1/action.yml

File renamed without changes.

‎ql/test/query-tests/Security/CWE-074/OutputClobberingHigh.expected

Lines changed: 8 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -1,12 +1,12 @@
11
edges
2-
| .github/workflows/output1.yml:9:18:9:49 | github.event.comment.body | .github/workflows/output1.yml:10:14:13:50 | # VULNERABLE\necho "OUTPUT_1=HARDCODED" >> $GITHUB_OUTPUT\necho "OUTPUT_2=$BODY" >> $GITHUB_OUTPUT\n | provenance | |
3-
| .github/workflows/output1.yml:30:9:35:6 | Uses Step | .github/workflows/output1.yml:36:14:38:58 | echo "OUTPUT_1=HARDCODED" >> $GITHUB_OUTPUT\necho "OUTPUT_2=$(<pr-number)" >> $GITHUB_OUTPUT\n | provenance | |
4-
| .github/workflows/output2.yml:9:18:9:49 | github.event.comment.body | .github/workflows/output2.yml:10:14:13:48 | # VULNERABLE\necho $BODY\necho "::set-output name=OUTPUT::SAFE"\n | provenance | |
5-
| .github/workflows/output2.yml:16:18:16:49 | github.event.comment.body | .github/workflows/output2.yml:17:14:20:21 | # VULNERABLE\necho "::set-output name=OUTPUT::SAFE"\necho $BODY\n | provenance | |
6-
| .github/workflows/output2.yml:36:9:41:6 | Uses Step | .github/workflows/output2.yml:42:14:46:48 | # VULNERABLE\nPR="$(<pr-number)"\necho "$PR"\necho "::set-output name=OUTPUT::SAFE"\n | provenance | |
7-
| .github/workflows/output2.yml:36:9:41:6 | Uses Step | .github/workflows/output2.yml:48:14:51:48 | # VULNERABLE\ncat pr-number\necho "::set-output name=OUTPUT::SAFE"\n | provenance | |
8-
| .github/workflows/output2.yml:36:9:41:6 | Uses Step | .github/workflows/output2.yml:53:14:56:19 | # VULNERABLE\necho "::set-output name=OUTPUT::SAFE"\nls *.txt\n | provenance | |
9-
| .github/workflows/output2.yml:36:9:41:6 | Uses Step | .github/workflows/output2.yml:58:14:62:48 | # VULNERABLE\nCURRENT_VERSION=$(cat gradle.properties \| sed -n '/^version=/ { s/^version=//;p }')\necho "$CURRENT_VERSION"\necho "::set-output name=OUTPUT::SAFE"\n | provenance | |
2+
| .github/workflows/output1.yml:9:18:9:49 | github.event.comment.body | .github/workflows/output1.yml:10:14:13:50 | # VULNERABLE\necho "OUTPUT_1=HARDCODED" >> $GITHUB_OUTPUT\necho "OUTPUT_2=$BODY" >> $GITHUB_OUTPUT\n | provenance | Config |
3+
| .github/workflows/output1.yml:30:9:35:6 | Uses Step | .github/workflows/output1.yml:36:14:38:58 | echo "OUTPUT_1=HARDCODED" >> $GITHUB_OUTPUT\necho "OUTPUT_2=$(<pr-number)" >> $GITHUB_OUTPUT\n | provenance | Config |
4+
| .github/workflows/output2.yml:9:18:9:49 | github.event.comment.body | .github/workflows/output2.yml:10:14:13:48 | # VULNERABLE\necho $BODY\necho "::set-output name=OUTPUT::SAFE"\n | provenance | Config |
5+
| .github/workflows/output2.yml:16:18:16:49 | github.event.comment.body | .github/workflows/output2.yml:17:14:20:21 | # VULNERABLE\necho "::set-output name=OUTPUT::SAFE"\necho $BODY\n | provenance | Config |
6+
| .github/workflows/output2.yml:36:9:41:6 | Uses Step | .github/workflows/output2.yml:42:14:46:48 | # VULNERABLE\nPR="$(<pr-number)"\necho "$PR"\necho "::set-output name=OUTPUT::SAFE"\n | provenance | Config |
7+
| .github/workflows/output2.yml:36:9:41:6 | Uses Step | .github/workflows/output2.yml:48:14:51:48 | # VULNERABLE\ncat pr-number\necho "::set-output name=OUTPUT::SAFE"\n | provenance | Config |
8+
| .github/workflows/output2.yml:36:9:41:6 | Uses Step | .github/workflows/output2.yml:53:14:56:19 | # VULNERABLE\necho "::set-output name=OUTPUT::SAFE"\nls *.txt\n | provenance | Config |
9+
| .github/workflows/output2.yml:36:9:41:6 | Uses Step | .github/workflows/output2.yml:58:14:62:48 | # VULNERABLE\nCURRENT_VERSION=$(cat gradle.properties \| sed -n '/^version=/ { s/^version=//;p }')\necho "$CURRENT_VERSION"\necho "::set-output name=OUTPUT::SAFE"\n | provenance | Config |
1010
nodes
1111
| .github/workflows/output1.yml:9:18:9:49 | github.event.comment.body | semmle.label | github.event.comment.body |
1212
| .github/workflows/output1.yml:10:14:13:50 | # VULNERABLE\necho "OUTPUT_1=HARDCODED" >> $GITHUB_OUTPUT\necho "OUTPUT_2=$BODY" >> $GITHUB_OUTPUT\n | semmle.label | # VULNERABLE\necho "OUTPUT_1=HARDCODED" >> $GITHUB_OUTPUT\necho "OUTPUT_2=$BODY" >> $GITHUB_OUTPUT\n |

‎ql/test/query-tests/Security/CWE-077/.github/workflows/test13.yml

Lines changed: 23 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,23 @@
1+
name: publish
2+
on:
3+
pull_request_target:
4+
branches:
5+
- main
6+
jobs:
7+
need-publish:
8+
permissions:
9+
actions: write
10+
name: Need Publish
11+
runs-on: ubuntu-latest
12+
steps:
13+
- name: Checkout
14+
uses: actions/checkout@v4
15+
with:
16+
ref: ${{ github.event.pull_request.head.ref }}
17+
- name: Get commit message
18+
run: |
19+
COMMIT_MESSAGE=$(git log --format=%s)
20+
echo "COMMIT_MESSAGE=${COMMIT_MESSAGE}" >> $GITHUB_ENV
21+
- name: Get commit message
22+
run: |
23+
echo "COMMIT_MESSAGE=$(git log --format=%s)" >> $GITHUB_ENV

‎ql/test/query-tests/Security/CWE-077/.github/workflows/test14.yml

Lines changed: 30 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,30 @@
1+
name: Pull Request Open
2+
3+
on:
4+
pull_request_target:
5+
6+
jobs:
7+
test1:
8+
runs-on: ubuntu-latest
9+
steps:
10+
- uses: actions/checkout@v2
11+
with:
12+
ref: ${{ github.event.pull_request.head.sha }}
13+
- id: changed-files
14+
run: |
15+
echo "CHANGED-FILES=$(git diff-tree --no-commit-id --name-only -r ${{ github.sha }} -- docs/)" >> "$GITHUB_ENV"
16+
- run: echo "${{ env.CHANGED-FILES }}"
17+
test2:
18+
runs-on: ubuntu-latest
19+
steps:
20+
- uses: actions/checkout@v2
21+
with:
22+
ref: ${{ github.event.pull_request.head.sha }}
23+
- id: changed-files
24+
run: |
25+
FILES=$(git diff-tree --no-commit-id --name-only -r ${{ github.sha }} -- docs/)
26+
echo "CHANGED-FILES=${FILES}" >> "$GITHUB_ENV"
27+
- run: echo "${{ env.CHANGED-FILES }}"
28+
29+
30+

‎ql/test/query-tests/Security/CWE-077/.github/workflows/test15.yml

Lines changed: 29 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,29 @@
1+
name: Pull Request Open
2+
3+
on:
4+
pull_request_target:
5+
6+
jobs:
7+
test1:
8+
runs-on: ubuntu-latest
9+
steps:
10+
- id: title
11+
run: |
12+
echo "BODY=$(jq --raw-output .pull_request.body ${GITHUB_EVENT_PATH})" >> "$GITHUB_ENV"
13+
- run: echo "$TITLE"
14+
test2:
15+
runs-on: ubuntu-latest
16+
steps:
17+
- id: title
18+
run: |
19+
PR_BODY=$(jq --raw-output .pull_request.body ${GITHUB_EVENT_PATH})
20+
echo "BODY=$PR_BODY" >> "$GITHUB_ENV"
21+
- run: echo "$TITLE"
22+
test3:
23+
runs-on: ubuntu-latest
24+
steps:
25+
- run: |
26+
echo "branch_name=$(jq --raw-output .pull_request.head.ref $GITHUB_EVENT_PATH)" >> $GITHUB_ENV
27+
28+
29+

‎ql/test/query-tests/Security/CWE-077/.github/workflows/test8.yml

Lines changed: 0 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -20,8 +20,6 @@ jobs:
2020
contents: write
2121
steps:
2222
- uses: actions/checkout@v4
23-
with:
24-
ref: foo
2523

2624
- name: Download and Extract Artifacts
2725
uses: dawidd6/action-download-artifact@v6

‎ql/test/query-tests/Security/CWE-077/EnvPathInjectionCritical.expected

Lines changed: 5 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -1,10 +1,9 @@
11
edges
2-
| .github/workflows/path1.yml:13:21:13:58 | github.event.pull_request.title | .github/workflows/path1.yml:14:14:14:52 | echo $(echo "$PATHINJ") >> $GITHUB_PATH | provenance | |
3-
| .github/workflows/path1.yml:16:21:16:58 | github.event.pull_request.title | .github/workflows/path1.yml:17:14:17:42 | echo $PATHINJ >> $GITHUB_PATH | provenance | |
4-
| .github/workflows/path1.yml:19:21:19:58 | github.event.pull_request.title | .github/workflows/path1.yml:20:14:20:44 | echo ${PATHINJ} >> $GITHUB_PATH | provenance | |
5-
| .github/workflows/path1.yml:21:9:25:6 | Uses Step | .github/workflows/path1.yml:25:14:25:50 | echo "$(cat foo/bar)" >> $GITHUB_PATH | provenance | |
6-
| .github/workflows/path1.yml:21:9:25:6 | Uses Step | .github/workflows/path1.yml:29:14:29:40 | echo "::add-path::$PATHINJ" | provenance | |
7-
| .github/workflows/path1.yml:28:21:28:58 | github.event.pull_request.title | .github/workflows/path1.yml:29:14:29:40 | echo "::add-path::$PATHINJ" | provenance | |
2+
| .github/workflows/path1.yml:13:21:13:58 | github.event.pull_request.title | .github/workflows/path1.yml:14:14:14:52 | echo $(echo "$PATHINJ") >> $GITHUB_PATH | provenance | Config |
3+
| .github/workflows/path1.yml:16:21:16:58 | github.event.pull_request.title | .github/workflows/path1.yml:17:14:17:42 | echo $PATHINJ >> $GITHUB_PATH | provenance | Config |
4+
| .github/workflows/path1.yml:19:21:19:58 | github.event.pull_request.title | .github/workflows/path1.yml:20:14:20:44 | echo ${PATHINJ} >> $GITHUB_PATH | provenance | Config |
5+
| .github/workflows/path1.yml:21:9:25:6 | Uses Step | .github/workflows/path1.yml:25:14:25:50 | echo "$(cat foo/bar)" >> $GITHUB_PATH | provenance | Config |
6+
| .github/workflows/path1.yml:28:21:28:58 | github.event.pull_request.title | .github/workflows/path1.yml:29:14:29:40 | echo "::add-path::$PATHINJ" | provenance | Config |
87
nodes
98
| .github/workflows/path1.yml:13:21:13:58 | github.event.pull_request.title | semmle.label | github.event.pull_request.title |
109
| .github/workflows/path1.yml:14:14:14:52 | echo $(echo "$PATHINJ") >> $GITHUB_PATH | semmle.label | echo $(echo "$PATHINJ") >> $GITHUB_PATH |

‎ql/test/query-tests/Security/CWE-077/EnvPathInjectionMedium.expected

Lines changed: 5 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -1,10 +1,9 @@
11
edges
2-
| .github/workflows/path1.yml:13:21:13:58 | github.event.pull_request.title | .github/workflows/path1.yml:14:14:14:52 | echo $(echo "$PATHINJ") >> $GITHUB_PATH | provenance | |
3-
| .github/workflows/path1.yml:16:21:16:58 | github.event.pull_request.title | .github/workflows/path1.yml:17:14:17:42 | echo $PATHINJ >> $GITHUB_PATH | provenance | |
4-
| .github/workflows/path1.yml:19:21:19:58 | github.event.pull_request.title | .github/workflows/path1.yml:20:14:20:44 | echo ${PATHINJ} >> $GITHUB_PATH | provenance | |
5-
| .github/workflows/path1.yml:21:9:25:6 | Uses Step | .github/workflows/path1.yml:25:14:25:50 | echo "$(cat foo/bar)" >> $GITHUB_PATH | provenance | |
6-
| .github/workflows/path1.yml:21:9:25:6 | Uses Step | .github/workflows/path1.yml:29:14:29:40 | echo "::add-path::$PATHINJ" | provenance | |
7-
| .github/workflows/path1.yml:28:21:28:58 | github.event.pull_request.title | .github/workflows/path1.yml:29:14:29:40 | echo "::add-path::$PATHINJ" | provenance | |
2+
| .github/workflows/path1.yml:13:21:13:58 | github.event.pull_request.title | .github/workflows/path1.yml:14:14:14:52 | echo $(echo "$PATHINJ") >> $GITHUB_PATH | provenance | Config |
3+
| .github/workflows/path1.yml:16:21:16:58 | github.event.pull_request.title | .github/workflows/path1.yml:17:14:17:42 | echo $PATHINJ >> $GITHUB_PATH | provenance | Config |
4+
| .github/workflows/path1.yml:19:21:19:58 | github.event.pull_request.title | .github/workflows/path1.yml:20:14:20:44 | echo ${PATHINJ} >> $GITHUB_PATH | provenance | Config |
5+
| .github/workflows/path1.yml:21:9:25:6 | Uses Step | .github/workflows/path1.yml:25:14:25:50 | echo "$(cat foo/bar)" >> $GITHUB_PATH | provenance | Config |
6+
| .github/workflows/path1.yml:28:21:28:58 | github.event.pull_request.title | .github/workflows/path1.yml:29:14:29:40 | echo "::add-path::$PATHINJ" | provenance | Config |
87
nodes
98
| .github/workflows/path1.yml:13:21:13:58 | github.event.pull_request.title | semmle.label | github.event.pull_request.title |
109
| .github/workflows/path1.yml:14:14:14:52 | echo $(echo "$PATHINJ") >> $GITHUB_PATH | semmle.label | echo $(echo "$PATHINJ") >> $GITHUB_PATH |

0 commit comments

Comments
 (0)