Skip to content

Commit ab7196a

Browse files
author
Alvaro Muñoz
committed
Fix FPs in EnvVarInjection
1 parent 9183fb0 commit ab7196a

File tree

3 files changed

+0
-46
lines changed

3 files changed

+0
-46
lines changed

‎ql/lib/codeql/actions/security/EnvVarInjectionQuery.qll

Lines changed: 0 additions & 18 deletions
Original file line numberDiff line numberDiff line change
@@ -24,28 +24,10 @@ predicate envVarInjectionFromFileSink(DataFlow::Node sink) {
2424
)
2525
}
2626

27-
/**
28-
* Holds if a Run step declares an environment variable, uses it to declare a new env var.
29-
* e.g.
30-
* env:
31-
* BODY: ${{ github.event.comment.body }}
32-
* run: |
33-
* echo "foo=$(echo $BODY)" >> $GITHUB_ENV
34-
*/
35-
predicate envVarInjectionFromEnvSink(DataFlow::Node sink) {
36-
exists(Run run, Expression expr, string varName, string value |
37-
sink.asExpr().getInScopeEnvVarExpr(varName) = expr and
38-
run = sink.asExpr() and
39-
Utils::writeToGitHubEnv(run, _, value) and
40-
value.indexOf("$" + ["", "{", "ENV{"] + varName) > 0
41-
)
42-
}
43-
4427
private class EnvVarInjectionSink extends DataFlow::Node {
4528
EnvVarInjectionSink() {
4629
envVarInjectionFromExprSink(this) or
4730
envVarInjectionFromFileSink(this) or
48-
envVarInjectionFromEnvSink(this) or
4931
externallyDefinedSink(this, "envvar-injection")
5032
}
5133
}

‎ql/test/query-tests/Security/CWE-077/EnvVarInjection.expected

Lines changed: 0 additions & 12 deletions
Original file line numberDiff line numberDiff line change
@@ -3,10 +3,6 @@ edges
33
| .github/workflows/test2.yml:17:9:47:6 | Uses Step | .github/workflows/test2.yml:47:9:52:6 | Run Step |
44
| .github/workflows/test3.yml:17:7:24:4 | Uses Step | .github/workflows/test3.yml:39:7:44:4 | Run Step |
55
| .github/workflows/test3.yml:24:7:31:4 | Uses Step | .github/workflows/test3.yml:39:7:44:4 | Run Step |
6-
| .github/workflows/test4.yml:22:19:22:56 | github.event.pull_request.title | .github/workflows/test4.yml:21:9:25:6 | Run Step |
7-
| .github/workflows/test4.yml:26:19:26:56 | github.event.pull_request.title | .github/workflows/test4.yml:25:9:31:6 | Run Step |
8-
| .github/workflows/test4.yml:32:19:32:56 | github.event.pull_request.title | .github/workflows/test4.yml:31:9:37:6 | Run Step |
9-
| .github/workflows/test4.yml:38:19:38:56 | github.event.pull_request.title | .github/workflows/test4.yml:37:9:45:6 | Run Step |
106
nodes
117
| .github/workflows/sonar-source.yml:17:9:37:6 | Uses Step | semmle.label | Uses Step |
128
| .github/workflows/sonar-source.yml:39:9:45:6 | Run Step | semmle.label | Run Step |
@@ -16,13 +12,5 @@ nodes
1612
| .github/workflows/test3.yml:17:7:24:4 | Uses Step | semmle.label | Uses Step |
1713
| .github/workflows/test3.yml:24:7:31:4 | Uses Step | semmle.label | Uses Step |
1814
| .github/workflows/test3.yml:39:7:44:4 | Run Step | semmle.label | Run Step |
19-
| .github/workflows/test4.yml:21:9:25:6 | Run Step | semmle.label | Run Step |
20-
| .github/workflows/test4.yml:22:19:22:56 | github.event.pull_request.title | semmle.label | github.event.pull_request.title |
21-
| .github/workflows/test4.yml:25:9:31:6 | Run Step | semmle.label | Run Step |
22-
| .github/workflows/test4.yml:26:19:26:56 | github.event.pull_request.title | semmle.label | github.event.pull_request.title |
23-
| .github/workflows/test4.yml:31:9:37:6 | Run Step | semmle.label | Run Step |
24-
| .github/workflows/test4.yml:32:19:32:56 | github.event.pull_request.title | semmle.label | github.event.pull_request.title |
25-
| .github/workflows/test4.yml:37:9:45:6 | Run Step | semmle.label | Run Step |
26-
| .github/workflows/test4.yml:38:19:38:56 | github.event.pull_request.title | semmle.label | github.event.pull_request.title |
2715
subpaths
2816
#select

‎ql/test/query-tests/Security/CWE-077/PrivilegedEnvVarInjection.expected

Lines changed: 0 additions & 16 deletions
Original file line numberDiff line numberDiff line change
@@ -3,10 +3,6 @@ edges
33
| .github/workflows/test2.yml:17:9:47:6 | Uses Step | .github/workflows/test2.yml:47:9:52:6 | Run Step |
44
| .github/workflows/test3.yml:17:7:24:4 | Uses Step | .github/workflows/test3.yml:39:7:44:4 | Run Step |
55
| .github/workflows/test3.yml:24:7:31:4 | Uses Step | .github/workflows/test3.yml:39:7:44:4 | Run Step |
6-
| .github/workflows/test4.yml:22:19:22:56 | github.event.pull_request.title | .github/workflows/test4.yml:21:9:25:6 | Run Step |
7-
| .github/workflows/test4.yml:26:19:26:56 | github.event.pull_request.title | .github/workflows/test4.yml:25:9:31:6 | Run Step |
8-
| .github/workflows/test4.yml:32:19:32:56 | github.event.pull_request.title | .github/workflows/test4.yml:31:9:37:6 | Run Step |
9-
| .github/workflows/test4.yml:38:19:38:56 | github.event.pull_request.title | .github/workflows/test4.yml:37:9:45:6 | Run Step |
106
nodes
117
| .github/workflows/sonar-source.yml:17:9:37:6 | Uses Step | semmle.label | Uses Step |
128
| .github/workflows/sonar-source.yml:39:9:45:6 | Run Step | semmle.label | Run Step |
@@ -16,22 +12,10 @@ nodes
1612
| .github/workflows/test3.yml:17:7:24:4 | Uses Step | semmle.label | Uses Step |
1713
| .github/workflows/test3.yml:24:7:31:4 | Uses Step | semmle.label | Uses Step |
1814
| .github/workflows/test3.yml:39:7:44:4 | Run Step | semmle.label | Run Step |
19-
| .github/workflows/test4.yml:21:9:25:6 | Run Step | semmle.label | Run Step |
20-
| .github/workflows/test4.yml:22:19:22:56 | github.event.pull_request.title | semmle.label | github.event.pull_request.title |
21-
| .github/workflows/test4.yml:25:9:31:6 | Run Step | semmle.label | Run Step |
22-
| .github/workflows/test4.yml:26:19:26:56 | github.event.pull_request.title | semmle.label | github.event.pull_request.title |
23-
| .github/workflows/test4.yml:31:9:37:6 | Run Step | semmle.label | Run Step |
24-
| .github/workflows/test4.yml:32:19:32:56 | github.event.pull_request.title | semmle.label | github.event.pull_request.title |
25-
| .github/workflows/test4.yml:37:9:45:6 | Run Step | semmle.label | Run Step |
26-
| .github/workflows/test4.yml:38:19:38:56 | github.event.pull_request.title | semmle.label | github.event.pull_request.title |
2715
subpaths
2816
#select
2917
| .github/workflows/sonar-source.yml:39:9:45:6 | Run Step | .github/workflows/sonar-source.yml:17:9:37:6 | Uses Step | .github/workflows/sonar-source.yml:39:9:45:6 | Run Step | Potential privileged environment variable injection in $@, which may be controlled by an external user. | .github/workflows/sonar-source.yml:39:9:45:6 | Run Step | Run Step |
3018
| .github/workflows/test1.yml:22:38:22:75 | github.event.pull_request.title | .github/workflows/test1.yml:22:38:22:75 | github.event.pull_request.title | .github/workflows/test1.yml:22:38:22:75 | github.event.pull_request.title | Potential privileged environment variable injection in $@, which may be controlled by an external user. | .github/workflows/test1.yml:22:38:22:75 | github.event.pull_request.title | github.event.pull_request.title |
3119
| .github/workflows/test2.yml:47:9:52:6 | Run Step | .github/workflows/test2.yml:17:9:47:6 | Uses Step | .github/workflows/test2.yml:47:9:52:6 | Run Step | Potential privileged environment variable injection in $@, which may be controlled by an external user. | .github/workflows/test2.yml:47:9:52:6 | Run Step | Run Step |
3220
| .github/workflows/test3.yml:39:7:44:4 | Run Step | .github/workflows/test3.yml:17:7:24:4 | Uses Step | .github/workflows/test3.yml:39:7:44:4 | Run Step | Potential privileged environment variable injection in $@, which may be controlled by an external user. | .github/workflows/test3.yml:39:7:44:4 | Run Step | Run Step |
3321
| .github/workflows/test3.yml:39:7:44:4 | Run Step | .github/workflows/test3.yml:24:7:31:4 | Uses Step | .github/workflows/test3.yml:39:7:44:4 | Run Step | Potential privileged environment variable injection in $@, which may be controlled by an external user. | .github/workflows/test3.yml:39:7:44:4 | Run Step | Run Step |
34-
| .github/workflows/test4.yml:21:9:25:6 | Run Step | .github/workflows/test4.yml:22:19:22:56 | github.event.pull_request.title | .github/workflows/test4.yml:21:9:25:6 | Run Step | Potential privileged environment variable injection in $@, which may be controlled by an external user. | .github/workflows/test4.yml:21:9:25:6 | Run Step | Run Step |
35-
| .github/workflows/test4.yml:25:9:31:6 | Run Step | .github/workflows/test4.yml:26:19:26:56 | github.event.pull_request.title | .github/workflows/test4.yml:25:9:31:6 | Run Step | Potential privileged environment variable injection in $@, which may be controlled by an external user. | .github/workflows/test4.yml:25:9:31:6 | Run Step | Run Step |
36-
| .github/workflows/test4.yml:31:9:37:6 | Run Step | .github/workflows/test4.yml:32:19:32:56 | github.event.pull_request.title | .github/workflows/test4.yml:31:9:37:6 | Run Step | Potential privileged environment variable injection in $@, which may be controlled by an external user. | .github/workflows/test4.yml:31:9:37:6 | Run Step | Run Step |
37-
| .github/workflows/test4.yml:37:9:45:6 | Run Step | .github/workflows/test4.yml:38:19:38:56 | github.event.pull_request.title | .github/workflows/test4.yml:37:9:45:6 | Run Step | Potential privileged environment variable injection in $@, which may be controlled by an external user. | .github/workflows/test4.yml:37:9:45:6 | Run Step | Run Step |

0 commit comments

Comments
 (0)