Skip to content

Commit fce300e

Browse files
author
Alvaro Muñoz
authored
Merge pull request #94 from github/fix/sanitizer_scalar_value
Fix: ControlChecks protects/dominates only work with Steps. A sink can be in a sub-step node (eg: ScalarValue)
2 parents 1b3b47b + f2c5a14 commit fce300e

File tree

13 files changed

+507
-17
lines changed

13 files changed

+507
-17
lines changed

‎ql/lib/codeql/actions/Ast.qll

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -13,6 +13,8 @@ class AstNode instanceof AstNodeImpl {
1313

1414
string toString() { result = super.toString() }
1515

16+
Step getEnclosingStep() { result = super.getEnclosingStep() }
17+
1618
Job getEnclosingJob() { result = super.getEnclosingJob() }
1719

1820
Workflow getEnclosingWorkflow() { result = super.getEnclosingWorkflow() }

‎ql/lib/codeql/actions/ast/internal/Ast.qll

Lines changed: 12 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -110,6 +110,18 @@ abstract class AstNodeImpl extends TAstNode {
110110
result = this.getEnclosingCompositeAction().getACallerJob()
111111
}
112112

113+
/**
114+
* Gets the enclosing Step.
115+
*/
116+
StepImpl getEnclosingStep() {
117+
if this instanceof StepImpl
118+
then result = this
119+
else
120+
if this instanceof ScalarValueImpl
121+
then result.getAChildNode*() = this.getParentNode()
122+
else none()
123+
}
124+
113125
/**
114126
* Gets the enclosing workflow if any.
115127
*/

‎ql/lib/codeql/actions/security/ControlChecks.qll

Lines changed: 11 additions & 11 deletions
Original file line numberDiff line numberDiff line change
@@ -37,39 +37,39 @@ abstract class ControlCheck extends AstNode {
3737
this instanceof Run
3838
}
3939

40-
predicate protects(Step step, Event event, string category) {
40+
predicate protects(AstNode node, Event event, string category) {
4141
// The check dominates the step it should protect
42-
this.dominates(step) and
42+
this.dominates(node) and
4343
// The check is effective against the event and category
4444
this.protectsCategoryAndEvent(category, event.getName()) and
4545
// The check can be triggered by the event
4646
this.getEnclosingJob().getATriggerEvent() = event
4747
}
4848

49-
predicate dominates(Step step) {
49+
predicate dominates(AstNode node) {
5050
this instanceof If and
5151
(
52-
step.getIf() = this or
53-
step.getEnclosingJob().getIf() = this or
54-
step.getEnclosingJob().getANeededJob().(LocalJob).getAStep().getIf() = this or
55-
step.getEnclosingJob().getANeededJob().(LocalJob).getIf() = this
52+
node.getEnclosingStep().getIf() = this or
53+
node.getEnclosingJob().getIf() = this or
54+
node.getEnclosingJob().getANeededJob().(LocalJob).getAStep().getIf() = this or
55+
node.getEnclosingJob().getANeededJob().(LocalJob).getIf() = this
5656
)
5757
or
5858
this instanceof Environment and
5959
(
60-
step.getEnclosingJob().getEnvironment() = this
60+
node.getEnclosingJob().getEnvironment() = this
6161
or
62-
step.getEnclosingJob().getANeededJob().getEnvironment() = this
62+
node.getEnclosingJob().getANeededJob().getEnvironment() = this
6363
)
6464
or
6565
(
6666
this instanceof Run or
6767
this instanceof UsesStep
6868
) and
6969
(
70-
this.(Step).getAFollowingStep() = step
70+
this.(Step).getAFollowingStep() = node.getEnclosingStep()
7171
or
72-
step.getEnclosingJob().getANeededJob().(LocalJob).getAStep() = this.(Step)
72+
node.getEnclosingJob().getANeededJob().(LocalJob).getAStep() = this.(Step)
7373
)
7474
}
7575

‎ql/src/Security/CWE-077/EnvVarInjectionCritical.ql

Lines changed: 6 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -22,19 +22,20 @@ from EnvVarInjectionFlow::PathNode source, EnvVarInjectionFlow::PathNode sink, E
2222
where
2323
EnvVarInjectionFlow::flowPath(source, sink) and
2424
inPrivilegedContext(sink.getNode().asExpr(), event) and
25-
not exists(ControlCheck check |
26-
check.protects(sink.getNode().asExpr(), event, "envvar-injection")
27-
) and
2825
// exclude paths to file read sinks from non-artifact sources
2926
(
27+
// source is text
3028
not source.getNode().(RemoteFlowSource).getSourceType() = "artifact" and
3129
not exists(ControlCheck check |
32-
check.protects(sink.getNode().asExpr(), event, "code-injection")
30+
check.protects(sink.getNode().asExpr(), event, ["envvar-injection", "code-injection"])
3331
)
3432
or
33+
// source is an artifact or a file from an untrusted checkout
3534
source.getNode().(RemoteFlowSource).getSourceType() = "artifact" and
3635
not exists(ControlCheck check |
37-
check.protects(sink.getNode().asExpr(), event, ["untrusted-checkout", "artifact-poisoning"])
36+
check
37+
.protects(sink.getNode().asExpr(), event,
38+
["envvar-injection", "untrusted-checkout", "artifact-poisoning"])
3839
) and
3940
(
4041
sink.getNode() instanceof EnvVarInjectionFromFileReadSink or

‎ql/src/Security/CWE-078/CommandInjectionCritical.ql

Lines changed: 5 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -16,11 +16,15 @@
1616
import actions
1717
import codeql.actions.security.CommandInjectionQuery
1818
import CommandInjectionFlow::PathGraph
19+
import codeql.actions.security.ControlChecks
1920

2021
from CommandInjectionFlow::PathNode source, CommandInjectionFlow::PathNode sink, Event event
2122
where
2223
CommandInjectionFlow::flowPath(source, sink) and
23-
inPrivilegedContext(sink.getNode().asExpr(), event)
24+
inPrivilegedContext(sink.getNode().asExpr(), event) and
25+
not exists(ControlCheck check |
26+
check.protects(sink.getNode().asExpr(), event, ["command-injection", "code-injection"])
27+
)
2428
select sink.getNode(), source, sink,
2529
"Potential command injection in $@, which may be controlled by an external user.", sink,
2630
sink.getNode().asExpr().(Expression).getRawExpression()

‎ql/test/query-tests/Security/CWE-077/.github/workflows/test11.yml

Lines changed: 81 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,81 @@
1+
name: Write prerelease comment
2+
3+
on:
4+
workflow_run:
5+
workflows: ["Create Pull Request Prerelease"]
6+
types:
7+
- completed
8+
9+
jobs:
10+
comment:
11+
if: ${{ github.repository_owner == 'cloudflare' }}
12+
runs-on: ubuntu-latest
13+
name: Write comment to the PR
14+
steps:
15+
- name: "Put PR and workflow ID on the environment"
16+
uses: actions/github-script@v7
17+
with:
18+
script: |
19+
// Copied from .github/extract-pr-and-workflow-id.js
20+
const allArtifacts = await github.rest.actions.listWorkflowRunArtifacts({
21+
owner: context.repo.owner,
22+
repo: context.repo.repo,
23+
run_id: context.payload.workflow_run.id,
24+
});
25+
26+
for (const artifact of allArtifacts.data.artifacts) {
27+
// Extract the PR number from the artifact name
28+
const match = /^npm-package-(.+)-(\d+)$/.exec(artifact.name);
29+
if (match) {
30+
const packageName = match[1].toUpperCase();
31+
require("fs").appendFileSync(
32+
process.env.GITHUB_ENV,
33+
`\nWORKFLOW_RUN_PR_FOR_${packageName}=${match[2]}` +
34+
`\nWORKFLOW_RUN_ID_FOR_${packageName}=${context.payload.workflow_run.id}`
35+
);
36+
}
37+
}
38+
39+
- name: "Download runtime versions"
40+
# Regular `actions/download-artifact` doesn't support downloading
41+
# artifacts from another workflow
42+
uses: dawidd6/action-download-artifact@v2
43+
with:
44+
run_id: ${{ github.event.workflow_run.id }}
45+
name: runtime-versions.md
46+
47+
- name: "Put runtime versions on the environment"
48+
id: runtime_versions
49+
run: |
50+
{
51+
echo 'RUNTIME_VERSIONS<<EOF'
52+
cat runtime-versions.md
53+
echo EOF
54+
} >> "$GITHUB_ENV"
55+
56+
- name: "Download pre-release report"
57+
uses: dawidd6/action-download-artifact@v2
58+
with:
59+
run_id: ${{ github.event.workflow_run.id }}
60+
name: prerelease-report.md
61+
62+
- name: "Put pre-release report on the environment"
63+
id: prerelease_report
64+
run: |
65+
{
66+
echo 'PRERELEASE_REPORT<<EOF'
67+
cat prerelease-report.md
68+
echo EOF
69+
} >> "$GITHUB_ENV"
70+
71+
- name: "Comment on PR with Wrangler link"
72+
uses: marocchino/sticky-pull-request-comment@v2
73+
with:
74+
number: ${{ env.WORKFLOW_RUN_PR_FOR_WRANGLER }}
75+
message: |
76+
${{ env.PRERELEASE_REPORT }}
77+
78+
---
79+
80+
${{ env.RUNTIME_VERSIONS }}
81+

‎ql/test/query-tests/Security/CWE-077/.github/workflows/test12.yml

Lines changed: 80 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,80 @@
1+
name: Write prerelease comment
2+
3+
on:
4+
workflow_run:
5+
workflows: ["Create Pull Request Prerelease"]
6+
types:
7+
- completed
8+
9+
jobs:
10+
comment:
11+
runs-on: ubuntu-latest
12+
name: Write comment to the PR
13+
steps:
14+
- name: "Put PR and workflow ID on the environment"
15+
uses: actions/github-script@v7
16+
with:
17+
script: |
18+
// Copied from .github/extract-pr-and-workflow-id.js
19+
const allArtifacts = await github.rest.actions.listWorkflowRunArtifacts({
20+
owner: context.repo.owner,
21+
repo: context.repo.repo,
22+
run_id: context.payload.workflow_run.id,
23+
});
24+
25+
for (const artifact of allArtifacts.data.artifacts) {
26+
// Extract the PR number from the artifact name
27+
const match = /^npm-package-(.+)-(\d+)$/.exec(artifact.name);
28+
if (match) {
29+
const packageName = match[1].toUpperCase();
30+
require("fs").appendFileSync(
31+
process.env.GITHUB_ENV,
32+
`\nWORKFLOW_RUN_PR_FOR_${packageName}=${match[2]}` +
33+
`\nWORKFLOW_RUN_ID_FOR_${packageName}=${context.payload.workflow_run.id}`
34+
);
35+
}
36+
}
37+
38+
- name: "Download runtime versions"
39+
# Regular `actions/download-artifact` doesn't support downloading
40+
# artifacts from another workflow
41+
uses: dawidd6/action-download-artifact@v2
42+
with:
43+
run_id: ${{ github.event.workflow_run.id }}
44+
name: runtime-versions.md
45+
46+
- name: "Put runtime versions on the environment"
47+
id: runtime_versions
48+
run: |
49+
{
50+
echo 'RUNTIME_VERSIONS<<EOF'
51+
cat runtime-versions.md
52+
echo EOF
53+
} >> "$GITHUB_ENV"
54+
55+
- name: "Download pre-release report"
56+
uses: dawidd6/action-download-artifact@v2
57+
with:
58+
run_id: ${{ github.event.workflow_run.id }}
59+
name: prerelease-report.md
60+
61+
- name: "Put pre-release report on the environment"
62+
id: prerelease_report
63+
run: |
64+
{
65+
echo 'PRERELEASE_REPORT<<EOF'
66+
cat prerelease-report.md
67+
echo EOF
68+
} >> "$GITHUB_ENV"
69+
70+
- name: "Comment on PR with Wrangler link"
71+
uses: marocchino/sticky-pull-request-comment@v2
72+
with:
73+
number: ${{ env.WORKFLOW_RUN_PR_FOR_WRANGLER }}
74+
message: |
75+
${{ env.PRERELEASE_REPORT }}
76+
77+
---
78+
79+
${{ env.RUNTIME_VERSIONS }}
80+

‎ql/test/query-tests/Security/CWE-077/EnvVarInjectionCritical.expected

Lines changed: 19 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -20,6 +20,14 @@ edges
2020
| .github/workflows/test8.yml:26:9:32:6 | Uses Step | .github/workflows/test8.yml:40:14:41:79 | echo "foo=$(< /artifacts/parent-artifacts/event.txt)" >> $GITHUB_ENV\n | provenance | |
2121
| .github/workflows/test9.yml:19:9:27:6 | Uses Step | .github/workflows/test9.yml:29:14:41:41 | pr_num=$(jq -r '.pull_request.number' artifacts/event_file/event.json)\nif [ -z "$pr_num" ] \|\| [ "$pr_num" == "null" ]; then\n pr_num=""\nfi\n\nref=$pr_num\nif [ -z "$ref" ] \|\| [ "$ref" == "null" ]; then\n ref=${{ github.ref }}\nfi\n\necho "pr_num=$pr_num" >> $GITHUB_ENV\necho "ref=$ref" >> $GITHUB_ENV\n | provenance | |
2222
| .github/workflows/test10.yml:20:9:26:6 | Uses Step | .github/workflows/test10.yml:27:14:27:59 | cat foo/.github/java-config.env >> $GITHUB_ENV | provenance | |
23+
| .github/workflows/test11.yml:39:9:47:6 | Uses Step | .github/workflows/test11.yml:49:14:54:29 | {\n echo 'RUNTIME_VERSIONS<<EOF'\n cat runtime-versions.md\n echo EOF\n} >> "$GITHUB_ENV"\n | provenance | |
24+
| .github/workflows/test11.yml:39:9:47:6 | Uses Step | .github/workflows/test11.yml:56:9:62:6 | Uses Step | provenance | |
25+
| .github/workflows/test11.yml:39:9:47:6 | Uses Step | .github/workflows/test11.yml:64:14:69:29 | {\n echo 'PRERELEASE_REPORT<<EOF'\n cat prerelease-report.md\n echo EOF\n} >> "$GITHUB_ENV"\n | provenance | |
26+
| .github/workflows/test11.yml:56:9:62:6 | Uses Step | .github/workflows/test11.yml:64:14:69:29 | {\n echo 'PRERELEASE_REPORT<<EOF'\n cat prerelease-report.md\n echo EOF\n} >> "$GITHUB_ENV"\n | provenance | |
27+
| .github/workflows/test12.yml:38:9:46:6 | Uses Step | .github/workflows/test12.yml:48:14:53:29 | {\n echo 'RUNTIME_VERSIONS<<EOF'\n cat runtime-versions.md\n echo EOF\n} >> "$GITHUB_ENV"\n | provenance | |
28+
| .github/workflows/test12.yml:38:9:46:6 | Uses Step | .github/workflows/test12.yml:55:9:61:6 | Uses Step | provenance | |
29+
| .github/workflows/test12.yml:38:9:46:6 | Uses Step | .github/workflows/test12.yml:63:14:68:29 | {\n echo 'PRERELEASE_REPORT<<EOF'\n cat prerelease-report.md\n echo EOF\n} >> "$GITHUB_ENV"\n | provenance | |
30+
| .github/workflows/test12.yml:55:9:61:6 | Uses Step | .github/workflows/test12.yml:63:14:68:29 | {\n echo 'PRERELEASE_REPORT<<EOF'\n cat prerelease-report.md\n echo EOF\n} >> "$GITHUB_ENV"\n | provenance | |
2331
nodes
2432
| .github/workflows/test2.yml:12:9:41:6 | Uses Step | semmle.label | Uses Step |
2533
| .github/workflows/test2.yml:41:14:43:52 | unzip pr.zip\necho "pr_number=$(cat NR)" >> $GITHUB_ENV\n | semmle.label | unzip pr.zip\necho "pr_number=$(cat NR)" >> $GITHUB_ENV\n |
@@ -61,6 +69,14 @@ nodes
6169
| .github/workflows/test9.yml:29:14:41:41 | pr_num=$(jq -r '.pull_request.number' artifacts/event_file/event.json)\nif [ -z "$pr_num" ] \|\| [ "$pr_num" == "null" ]; then\n pr_num=""\nfi\n\nref=$pr_num\nif [ -z "$ref" ] \|\| [ "$ref" == "null" ]; then\n ref=${{ github.ref }}\nfi\n\necho "pr_num=$pr_num" >> $GITHUB_ENV\necho "ref=$ref" >> $GITHUB_ENV\n | semmle.label | pr_num=$(jq -r '.pull_request.number' artifacts/event_file/event.json)\nif [ -z "$pr_num" ] \|\| [ "$pr_num" == "null" ]; then\n pr_num=""\nfi\n\nref=$pr_num\nif [ -z "$ref" ] \|\| [ "$ref" == "null" ]; then\n ref=${{ github.ref }}\nfi\n\necho "pr_num=$pr_num" >> $GITHUB_ENV\necho "ref=$ref" >> $GITHUB_ENV\n |
6270
| .github/workflows/test10.yml:20:9:26:6 | Uses Step | semmle.label | Uses Step |
6371
| .github/workflows/test10.yml:27:14:27:59 | cat foo/.github/java-config.env >> $GITHUB_ENV | semmle.label | cat foo/.github/java-config.env >> $GITHUB_ENV |
72+
| .github/workflows/test11.yml:39:9:47:6 | Uses Step | semmle.label | Uses Step |
73+
| .github/workflows/test11.yml:49:14:54:29 | {\n echo 'RUNTIME_VERSIONS<<EOF'\n cat runtime-versions.md\n echo EOF\n} >> "$GITHUB_ENV"\n | semmle.label | {\n echo 'RUNTIME_VERSIONS<<EOF'\n cat runtime-versions.md\n echo EOF\n} >> "$GITHUB_ENV"\n |
74+
| .github/workflows/test11.yml:56:9:62:6 | Uses Step | semmle.label | Uses Step |
75+
| .github/workflows/test11.yml:64:14:69:29 | {\n echo 'PRERELEASE_REPORT<<EOF'\n cat prerelease-report.md\n echo EOF\n} >> "$GITHUB_ENV"\n | semmle.label | {\n echo 'PRERELEASE_REPORT<<EOF'\n cat prerelease-report.md\n echo EOF\n} >> "$GITHUB_ENV"\n |
76+
| .github/workflows/test12.yml:38:9:46:6 | Uses Step | semmle.label | Uses Step |
77+
| .github/workflows/test12.yml:48:14:53:29 | {\n echo 'RUNTIME_VERSIONS<<EOF'\n cat runtime-versions.md\n echo EOF\n} >> "$GITHUB_ENV"\n | semmle.label | {\n echo 'RUNTIME_VERSIONS<<EOF'\n cat runtime-versions.md\n echo EOF\n} >> "$GITHUB_ENV"\n |
78+
| .github/workflows/test12.yml:55:9:61:6 | Uses Step | semmle.label | Uses Step |
79+
| .github/workflows/test12.yml:63:14:68:29 | {\n echo 'PRERELEASE_REPORT<<EOF'\n cat prerelease-report.md\n echo EOF\n} >> "$GITHUB_ENV"\n | semmle.label | {\n echo 'PRERELEASE_REPORT<<EOF'\n cat prerelease-report.md\n echo EOF\n} >> "$GITHUB_ENV"\n |
6480
subpaths
6581
#select
6682
| .github/workflows/test2.yml:41:14:43:52 | unzip pr.zip\necho "pr_number=$(cat NR)" >> $GITHUB_ENV\n | .github/workflows/test2.yml:12:9:41:6 | Uses Step | .github/workflows/test2.yml:41:14:43:52 | unzip pr.zip\necho "pr_number=$(cat NR)" >> $GITHUB_ENV\n | Potential environment variable injection in $@, which may be controlled by an external user. | .github/workflows/test2.yml:41:14:43:52 | unzip pr.zip\necho "pr_number=$(cat NR)" >> $GITHUB_ENV\n | unzip pr.zip\necho "pr_number=$(cat NR)" >> $GITHUB_ENV\n |
@@ -84,3 +100,6 @@ subpaths
84100
| .github/workflows/test8.yml:40:14:41:79 | echo "foo=$(< /artifacts/parent-artifacts/event.txt)" >> $GITHUB_ENV\n | .github/workflows/test8.yml:26:9:32:6 | Uses Step | .github/workflows/test8.yml:40:14:41:79 | echo "foo=$(< /artifacts/parent-artifacts/event.txt)" >> $GITHUB_ENV\n | Potential environment variable injection in $@, which may be controlled by an external user. | .github/workflows/test8.yml:40:14:41:79 | echo "foo=$(< /artifacts/parent-artifacts/event.txt)" >> $GITHUB_ENV\n | echo "foo=$(< /artifacts/parent-artifacts/event.txt)" >> $GITHUB_ENV\n |
85101
| .github/workflows/test9.yml:29:14:41:41 | pr_num=$(jq -r '.pull_request.number' artifacts/event_file/event.json)\nif [ -z "$pr_num" ] \|\| [ "$pr_num" == "null" ]; then\n pr_num=""\nfi\n\nref=$pr_num\nif [ -z "$ref" ] \|\| [ "$ref" == "null" ]; then\n ref=${{ github.ref }}\nfi\n\necho "pr_num=$pr_num" >> $GITHUB_ENV\necho "ref=$ref" >> $GITHUB_ENV\n | .github/workflows/test9.yml:19:9:27:6 | Uses Step | .github/workflows/test9.yml:29:14:41:41 | pr_num=$(jq -r '.pull_request.number' artifacts/event_file/event.json)\nif [ -z "$pr_num" ] \|\| [ "$pr_num" == "null" ]; then\n pr_num=""\nfi\n\nref=$pr_num\nif [ -z "$ref" ] \|\| [ "$ref" == "null" ]; then\n ref=${{ github.ref }}\nfi\n\necho "pr_num=$pr_num" >> $GITHUB_ENV\necho "ref=$ref" >> $GITHUB_ENV\n | Potential environment variable injection in $@, which may be controlled by an external user. | .github/workflows/test9.yml:29:14:41:41 | pr_num=$(jq -r '.pull_request.number' artifacts/event_file/event.json)\nif [ -z "$pr_num" ] \|\| [ "$pr_num" == "null" ]; then\n pr_num=""\nfi\n\nref=$pr_num\nif [ -z "$ref" ] \|\| [ "$ref" == "null" ]; then\n ref=${{ github.ref }}\nfi\n\necho "pr_num=$pr_num" >> $GITHUB_ENV\necho "ref=$ref" >> $GITHUB_ENV\n | pr_num=$(jq -r '.pull_request.number' artifacts/event_file/event.json)\nif [ -z "$pr_num" ] \|\| [ "$pr_num" == "null" ]; then\n pr_num=""\nfi\n\nref=$pr_num\nif [ -z "$ref" ] \|\| [ "$ref" == "null" ]; then\n ref=${{ github.ref }}\nfi\n\necho "pr_num=$pr_num" >> $GITHUB_ENV\necho "ref=$ref" >> $GITHUB_ENV\n |
86102
| .github/workflows/test10.yml:27:14:27:59 | cat foo/.github/java-config.env >> $GITHUB_ENV | .github/workflows/test10.yml:20:9:26:6 | Uses Step | .github/workflows/test10.yml:27:14:27:59 | cat foo/.github/java-config.env >> $GITHUB_ENV | Potential environment variable injection in $@, which may be controlled by an external user. | .github/workflows/test10.yml:27:14:27:59 | cat foo/.github/java-config.env >> $GITHUB_ENV | cat foo/.github/java-config.env >> $GITHUB_ENV |
103+
| .github/workflows/test12.yml:48:14:53:29 | {\n echo 'RUNTIME_VERSIONS<<EOF'\n cat runtime-versions.md\n echo EOF\n} >> "$GITHUB_ENV"\n | .github/workflows/test12.yml:38:9:46:6 | Uses Step | .github/workflows/test12.yml:48:14:53:29 | {\n echo 'RUNTIME_VERSIONS<<EOF'\n cat runtime-versions.md\n echo EOF\n} >> "$GITHUB_ENV"\n | Potential environment variable injection in $@, which may be controlled by an external user. | .github/workflows/test12.yml:48:14:53:29 | {\n echo 'RUNTIME_VERSIONS<<EOF'\n cat runtime-versions.md\n echo EOF\n} >> "$GITHUB_ENV"\n | {\n echo 'RUNTIME_VERSIONS<<EOF'\n cat runtime-versions.md\n echo EOF\n} >> "$GITHUB_ENV"\n |
104+
| .github/workflows/test12.yml:63:14:68:29 | {\n echo 'PRERELEASE_REPORT<<EOF'\n cat prerelease-report.md\n echo EOF\n} >> "$GITHUB_ENV"\n | .github/workflows/test12.yml:38:9:46:6 | Uses Step | .github/workflows/test12.yml:63:14:68:29 | {\n echo 'PRERELEASE_REPORT<<EOF'\n cat prerelease-report.md\n echo EOF\n} >> "$GITHUB_ENV"\n | Potential environment variable injection in $@, which may be controlled by an external user. | .github/workflows/test12.yml:63:14:68:29 | {\n echo 'PRERELEASE_REPORT<<EOF'\n cat prerelease-report.md\n echo EOF\n} >> "$GITHUB_ENV"\n | {\n echo 'PRERELEASE_REPORT<<EOF'\n cat prerelease-report.md\n echo EOF\n} >> "$GITHUB_ENV"\n |
105+
| .github/workflows/test12.yml:63:14:68:29 | {\n echo 'PRERELEASE_REPORT<<EOF'\n cat prerelease-report.md\n echo EOF\n} >> "$GITHUB_ENV"\n | .github/workflows/test12.yml:55:9:61:6 | Uses Step | .github/workflows/test12.yml:63:14:68:29 | {\n echo 'PRERELEASE_REPORT<<EOF'\n cat prerelease-report.md\n echo EOF\n} >> "$GITHUB_ENV"\n | Potential environment variable injection in $@, which may be controlled by an external user. | .github/workflows/test12.yml:63:14:68:29 | {\n echo 'PRERELEASE_REPORT<<EOF'\n cat prerelease-report.md\n echo EOF\n} >> "$GITHUB_ENV"\n | {\n echo 'PRERELEASE_REPORT<<EOF'\n cat prerelease-report.md\n echo EOF\n} >> "$GITHUB_ENV"\n |

0 commit comments

Comments
 (0)