Skip to content

Commit c7c1eca

Browse files
owen-mcowen-mc
authored
Merge branch 'main' into copilot/investigate-missing-alerts
2 parents 1f9899d + 3dd3e2c commit c7c1eca

1,209 files changed

Lines changed: 59391 additions & 7399 deletions

File tree

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

‎CODEOWNERS‎

Lines changed: 1 addition & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -2,7 +2,7 @@
22
* @github/code-scanning-alert-coverage
33

44
# CodeQL language libraries
5-
/actions/ @github/codeql-dynamic
5+
/actions/ @github/code-scanning-alert-coverage
66
/cpp/ @github/codeql-c-analysis
77
/csharp/ @github/codeql-csharp
88
/csharp/autobuilder/Semmle.Autobuild.Cpp @github/codeql-c-extractor @github/code-scanning-language-coverage
@@ -59,9 +59,5 @@ MODULE.bazel @github/codeql-ci-reviewers
5959
/.github/workflows/rust.yml @github/codeql-rust
6060
/.github/workflows/swift.yml @github/codeql-swift
6161

62-
# Misc
63-
/misc/scripts/accept-expected-changes-from-ci.py @RasmusWL
64-
/misc/scripts/generate-code-scanning-query-list.py @RasmusWL
65-
6662
# .devcontainer
6763
/.devcontainer/ @github/codeql-ci-reviewers

‎actions/ql/lib/CHANGELOG.md‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -2,7 +2,7 @@
22

33
### Minor Analysis Improvements
44

5-
* The GitHub Actions analysis now recognizes more Bash regex checks that restrict a value to alphanumeric characters, include regexes like `^[0-9a-zA-Z]{40}([0-9a-zA-Z]{24})?$` which check for a sha1 or sha256 hash. This may reduce false positive results where command output is validated with grouped or optional alphanumeric patterns before being used.
5+
* The GitHub Actions analysis now recognizes more Bash regex checks that restrict a value to alphanumeric characters, including regexes like `^[0-9a-zA-Z]{40}([0-9a-zA-Z]{24})?$` which check for a SHA-1 or SHA-256 hash. This may reduce false positive results where command output is validated with grouped or optional alphanumeric patterns before being used.
66

77
## 0.4.36
88

‎actions/ql/lib/change-notes/2026-06-12-self_hosted_runners.md‎

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,4 @@
1+
---
2+
category: fix
3+
---
4+
* The query `actions/pr-on-self-hosted-runner` was updated to the latest standard runner labels reducing false positive results.

‎actions/ql/lib/change-notes/released/0.4.37.md‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -2,4 +2,4 @@
22

33
### Minor Analysis Improvements
44

5-
* The GitHub Actions analysis now recognizes more Bash regex checks that restrict a value to alphanumeric characters, include regexes like `^[0-9a-zA-Z]{40}([0-9a-zA-Z]{24})?$` which check for a sha1 or sha256 hash. This may reduce false positive results where command output is validated with grouped or optional alphanumeric patterns before being used.
5+
* The GitHub Actions analysis now recognizes more Bash regex checks that restrict a value to alphanumeric characters, including regexes like `^[0-9a-zA-Z]{40}([0-9a-zA-Z]{24})?$` which check for a SHA-1 or SHA-256 hash. This may reduce false positive results where command output is validated with grouped or optional alphanumeric patterns before being used.

‎actions/ql/lib/codeql/actions/ast/internal/Ast.qll‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1920,3 +1920,5 @@ private YamlMappingLikeNode resolveMatrixAccessPath(
19201920
else result = resolveMatrixAccessPath(newRoot, rest)
19211921
)
19221922
}
1923+
1924+
class Comment = YamlComment;

‎actions/ql/lib/codeql/actions/ast/internal/Yaml.qll‎

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -52,6 +52,12 @@ private module YamlSig implements LibYaml::InputSig {
5252
class ParseErrorBase extends LocatableBase, @yaml_error {
5353
string getMessage() { yaml_errors(this, result) }
5454
}
55+
56+
class CommentBase extends LocatableBase, @yaml_comment {
57+
string getText() { yaml_comments(this, result, _) }
58+
59+
override string toString() { yaml_comments(this, _, result) }
60+
}
5561
}
5662

5763
import LibYaml::Make<YamlSig>

‎actions/ql/lib/codeql/actions/security/SelfHostedQuery.qll‎

Lines changed: 6 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -2,10 +2,12 @@ import actions
22

33
bindingset[runner]
44
predicate isGithubHostedRunner(string runner) {
5-
// list of github hosted repos: https://github.com/actions/runner-images/blob/main/README.md#available-images
6-
runner
7-
.toLowerCase()
8-
.regexpMatch("^(ubuntu-([0-9.]+|latest)|macos-([0-9]+|latest)(-x?large)?|windows-([0-9.]+|latest))$")
5+
// The list of github hosted repos:
6+
// https://github.com/actions/runner-images/blob/main/README.md#available-images
7+
// https://docs.github.com/en/enterprise-cloud@latest/actions/how-tos/write-workflows/choose-where-workflows-run/choose-the-runner-for-a-job#standard-github-hosted-runners-for-public-repositories
8+
runner.toLowerCase().regexpMatch("^ubuntu-([0-9.]+|latest|slim)(-arm)?$") or
9+
runner.toLowerCase().regexpMatch("^macos-([0-9]+|latest)(-x?large|-intel)?$") or
10+
runner.toLowerCase().regexpMatch("^windows-([0-9.]+|latest)(-vs[0-9.]+)?(-arm)?$")
911
}
1012

1113
bindingset[runner]

‎actions/ql/src/CHANGELOG.md‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -15,7 +15,7 @@
1515

1616
### Bug Fixes
1717

18-
* Adjusted (minor) help file descriptions for queries: `actions/untrusted-checkout/critical`, `actions/untrusted-checkout/high`, `actions/untrusted-checkout/medium`. Clarified wording on in minor point, added one more listed resource and added one more recommendation for things to check.
18+
* Adjusted (minor) help file descriptions for queries: `actions/untrusted-checkout/critical`, `actions/untrusted-checkout/high`, `actions/untrusted-checkout/medium`. Clarified wording on a minor point, added one more listed resource and added one more recommendation for things to check.
1919

2020
## 0.6.28
2121

‎actions/ql/src/Security/CWE-829/UntrustedCheckoutMedium.ql‎

Lines changed: 5 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -1,8 +1,8 @@
11
/**
2-
* @name Checkout of untrusted code in a trusted context
3-
* @description Privileged workflows have read/write access to the base repository and access to secrets.
4-
* By explicitly checking out and running the build script from a fork the untrusted code is running in an environment
5-
* that is able to push to the base repository and to access secrets.
2+
* @name Checkout of untrusted code in a non-privileged context
3+
* @description Checking out and running the build script from a fork executes untrusted code. Even in a
4+
* non-privileged workflow, this can be abused, for example to compromise self-hosted runners
5+
* or to poison caches and artifacts that are later consumed by privileged workflows.
66
* @kind problem
77
* @problem.severity warning
88
* @precision medium
@@ -20,4 +20,4 @@ from PRHeadCheckoutStep checkout
2020
where
2121
// the checkout occurs in a non-privileged context
2222
inNonPrivilegedContext(checkout)
23-
select checkout, "Potential unsafe checkout of untrusted pull request on privileged workflow."
23+
select checkout, "Potential unsafe checkout of untrusted pull request on non-privileged workflow."

‎actions/ql/src/change-notes/2026-06-04-untrusted-checkout-medium-metadata.md‎

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,4 @@
1+
---
2+
category: queryMetadata
3+
---
4+
* The name, description, and alert message of `actions/untrusted-checkout/medium` have been corrected to describe a non-privileged context.

0 commit comments

Comments
 (0)