Skip to content

Commit 257d949

Browse files
geoffw0geoffw0
committed
Merge branch 'main' into pin
2 parents 355864d + 4c9c8bc commit 257d949

File tree

232 files changed

+21426
-7226
lines changed

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

232 files changed

+21426
-7226
lines changed

‎.github/workflows/swift.yml

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -32,7 +32,7 @@ jobs:
3232
if: github.repository_owner == 'github'
3333
strategy:
3434
matrix:
35-
runner: [ubuntu-latest, macos-13-xlarge]
35+
runner: [ubuntu-latest, macos-15-xlarge]
3636
fail-fast: false
3737
runs-on: ${{ matrix.runner }}
3838
steps:

‎.gitignore

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -72,3 +72,7 @@ node_modules/
7272

7373
# cargo build directory
7474
/target
75+
76+
# some upgrade/downgrade checks create these files
77+
**/upgrades/*/*.dbscheme.stats
78+
**/downgrades/*/*.dbscheme.stats

‎actions/ql/lib/ext/config/actions_permissions.yml

Lines changed: 9 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -22,16 +22,21 @@ extensions:
2222
- ["actions/stale", "pull-requests: write"]
2323
- ["actions/attest-build-provenance", "id-token: write"]
2424
- ["actions/attest-build-provenance", "attestations: write"]
25+
- ["actions/deploy-pages", "pages: write"]
26+
- ["actions/deploy-pages", "id-token: write"]
27+
- ["actions/delete-package-versions", "packages: write"]
2528
- ["actions/jekyll-build-pages", "contents: read"]
2629
- ["actions/jekyll-build-pages", "pages: write"]
2730
- ["actions/jekyll-build-pages", "id-token: write"]
2831
- ["actions/publish-action", "contents: write"]
29-
- ["actions/versions-package-tools", "contents: read"]
32+
- ["actions/versions-package-tools", "contents: read"]
3033
- ["actions/versions-package-tools", "actions: read"]
31-
- ["actions/reusable-workflows", "contents: read"]
34+
- ["actions/reusable-workflows", "contents: read"]
3235
- ["actions/reusable-workflows", "actions: read"]
36+
- ["actions/ai-inference", "contents: read"]
37+
- ["actions/ai-inference", "models: read"]
3338
# TODO: Add permissions for actions/download-artifact
3439
# TODO: Add permissions for actions/upload-artifact
40+
# No permissions needed for actions/upload-pages-artifact
3541
# TODO: Add permissions for actions/cache
36-
37-
42+
# No permissions needed for actions/configure-pages

‎actions/ql/src/change-notes/2025-05-14-minimal-permission-for-add-to-project.md

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,4 @@
1+
---
2+
category: minorAnalysis
3+
---
4+
* The query `actions/missing-workflow-permissions` is now aware of the minimal permissions needed for the actions `deploy-pages`, `delete-package-versions`, `ai-inference`. This should lead to better alert messages and better fix suggestions.

‎actions/ql/test/query-tests/Security/CWE-275/.github/workflows/perms10.yml

Lines changed: 10 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,10 @@
1+
on:
2+
workflow_call:
3+
workflow_dispatch:
4+
5+
jobs:
6+
build:
7+
name: Build and test
8+
runs-on: ubuntu-latest
9+
steps:
10+
- uses: actions/ai-inference

‎actions/ql/test/query-tests/Security/CWE-275/.github/workflows/perms8.yml

Lines changed: 10 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,10 @@
1+
on:
2+
workflow_call:
3+
workflow_dispatch:
4+
5+
jobs:
6+
build:
7+
name: Build and test
8+
runs-on: ubuntu-latest
9+
steps:
10+
- uses: actions/deploy-pages

‎actions/ql/test/query-tests/Security/CWE-275/.github/workflows/perms9.yml

Lines changed: 10 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,10 @@
1+
on:
2+
workflow_call:
3+
workflow_dispatch:
4+
5+
jobs:
6+
build:
7+
name: Build and test
8+
runs-on: ubuntu-latest
9+
steps:
10+
- uses: actions/delete-package-versions

‎actions/ql/test/query-tests/Security/CWE-275/MissingActionsPermissions.expected

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -3,3 +3,6 @@
33
| .github/workflows/perms5.yml:7:5:10:32 | Job: build | Actions job or workflow does not limit the permissions of the GITHUB_TOKEN. Consider setting an explicit permissions block, using the following as a minimal starting point: {contents: read} |
44
| .github/workflows/perms6.yml:7:5:11:39 | Job: build | Actions job or workflow does not limit the permissions of the GITHUB_TOKEN. Consider setting an explicit permissions block, using the following as a minimal starting point: {contents: read, id-token: write, pages: write} |
55
| .github/workflows/perms7.yml:7:5:10:38 | Job: build | Actions job or workflow does not limit the permissions of the GITHUB_TOKEN. Consider setting an explicit permissions block, using the following as a minimal starting point: {} |
6+
| .github/workflows/perms8.yml:7:5:10:33 | Job: build | Actions job or workflow does not limit the permissions of the GITHUB_TOKEN. Consider setting an explicit permissions block, using the following as a minimal starting point: {id-token: write, pages: write} |
7+
| .github/workflows/perms9.yml:7:5:10:44 | Job: build | Actions job or workflow does not limit the permissions of the GITHUB_TOKEN. Consider setting an explicit permissions block, using the following as a minimal starting point: {packages: write} |
8+
| .github/workflows/perms10.yml:7:5:10:33 | Job: build | Actions job or workflow does not limit the permissions of the GITHUB_TOKEN. Consider setting an explicit permissions block, using the following as a minimal starting point: {contents: read, models: read} |

‎cpp/ql/lib/experimental/quantum/Language.qll

Lines changed: 17 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,7 @@
11
private import cpp as Language
2-
import semmle.code.cpp.dataflow.new.DataFlow
2+
import semmle.code.cpp.dataflow.new.TaintTracking
33
import codeql.quantum.experimental.Model
4+
private import OpenSSL.GenericSourceCandidateLiteral
45

56
module CryptoInput implements InputSig<Language::Location> {
67
class DataFlowNode = DataFlow::Node;
@@ -86,6 +87,21 @@ module GenericDataSourceFlowConfig implements DataFlow::ConfigSig {
8687
}
8788
}
8889

90+
module GenericDataSourceFlow = TaintTracking::Global<GenericDataSourceFlowConfig>;
91+
92+
private class ConstantDataSource extends Crypto::GenericConstantSourceInstance instanceof Literal {
93+
ConstantDataSource() { this instanceof OpenSSLGenericSourceCandidateLiteral }
94+
95+
override DataFlow::Node getOutputNode() { result.asExpr() = this }
96+
97+
override predicate flowsTo(Crypto::FlowAwareElement other) {
98+
// TODO: separate config to avoid blowing up data-flow analysis
99+
GenericDataSourceFlow::flow(this.getOutputNode(), other.getInputNode())
100+
}
101+
102+
override string getAdditionalDescription() { result = this.toString() }
103+
}
104+
89105
module ArtifactUniversalFlowConfig implements DataFlow::ConfigSig {
90106
predicate isSource(DataFlow::Node source) {
91107
source = any(Crypto::ArtifactInstance artifact).getOutputNode()

‎cpp/ql/lib/experimental/quantum/OpenSSL/AlgorithmInstances/AlgToAVCFlow.qll

Lines changed: 5 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -3,6 +3,7 @@ private import experimental.quantum.Language
33
private import semmle.code.cpp.dataflow.new.DataFlow
44
private import experimental.quantum.OpenSSL.AlgorithmInstances.KnownAlgorithmConstants
55
private import experimental.quantum.OpenSSL.AlgorithmValueConsumers.OpenSSLAlgorithmValueConsumers
6+
private import PaddingAlgorithmInstance
67

78
/**
89
* Traces 'known algorithms' to AVCs, specifically
@@ -19,6 +20,9 @@ module KnownOpenSSLAlgorithmToAlgorithmValueConsumerConfig implements DataFlow::
1920
predicate isSink(DataFlow::Node sink) {
2021
exists(OpenSSLAlgorithmValueConsumer c |
2122
c.getInputNode() = sink and
23+
// exclude padding algorithm consumers, since
24+
// these consumers take in different constant values
25+
// not in the typical "known algorithm" set
2226
not c instanceof PaddingAlgorithmValueConsumer
2327
)
2428
}
@@ -43,9 +47,7 @@ module KnownOpenSSLAlgorithmToAlgorithmValueConsumerFlow =
4347
DataFlow::Global<KnownOpenSSLAlgorithmToAlgorithmValueConsumerConfig>;
4448

4549
module RSAPaddingAlgorithmToPaddingAlgorithmValueConsumerConfig implements DataFlow::ConfigSig {
46-
predicate isSource(DataFlow::Node source) {
47-
source.asExpr() instanceof KnownOpenSSLAlgorithmConstant
48-
}
50+
predicate isSource(DataFlow::Node source) { source.asExpr() instanceof OpenSSLPaddingLiteral }
4951

5052
predicate isSink(DataFlow::Node sink) {
5153
exists(PaddingAlgorithmValueConsumer c | c.getInputNode() = sink)

0 commit comments

Comments
 (0)
pFad - Phonifier reborn

Pfad - The Proxy pFad of © 2024 Garber Painting. All rights reserved.

Note: This service is not intended for secure transactions such as banking, social media, email, or purchasing. Use at your own risk. We assume no liability whatsoever for broken pages.


Alternative Proxies:

Alternative Proxy

pFad Proxy

pFad v3 Proxy

pFad v4 Proxy