Skip to content

Commit 1900b61

Browse files
JarLobJarLob
committed
Add tests
1 parent 8a89360 commit 1900b61

5 files changed

Lines changed: 73 additions & 0 deletions

File tree

‎actions/ql/test/query-tests/Security/CWE-349/.github/workflows/cache_write_capable_reusable_workflow.yml‎

Lines changed: 45 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,45 @@
1+
on:
2+
workflow_call:
3+
inputs:
4+
head_sha:
5+
required: false
6+
type: string
7+
8+
jobs:
9+
direct-cache:
10+
if: github.event_name == 'workflow_dispatch'
11+
permissions: {}
12+
runs-on: ubuntu-latest
13+
steps:
14+
- uses: actions/checkout@v4
15+
- env:
16+
HEAD_SHA: ${{ inputs.head_sha }}
17+
run: |
18+
[[ "$HEAD_SHA" =~ ^[0-9a-fA-F]{40}$ ]] || exit 1
19+
git fetch origin "$HEAD_SHA"
20+
git checkout --detach "$HEAD_SHA"
21+
- uses: actions/cache@v4
22+
with:
23+
path: .npm
24+
key: reusable-direct-cache
25+
26+
poisonable-step:
27+
if: github.event_name == 'workflow_dispatch'
28+
permissions: {}
29+
runs-on: ubuntu-latest
30+
steps:
31+
- uses: actions/checkout@v4
32+
- env:
33+
HEAD_SHA: ${{ inputs.head_sha }}
34+
run: |
35+
[[ "$HEAD_SHA" =~ ^[0-9a-fA-F]{40}$ ]] || exit 1
36+
git fetch origin "$HEAD_SHA"
37+
git checkout --detach "$HEAD_SHA"
38+
- run: npm install
39+
40+
code-injection:
41+
if: github.event_name == 'push'
42+
permissions: {}
43+
runs-on: ubuntu-latest
44+
steps:
45+
- run: echo "${{ github.event.head_commit.message }}"

‎actions/ql/test/query-tests/Security/CWE-349/.github/workflows/cache_write_capable_reusable_workflow_caller.yml‎

Lines changed: 16 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,16 @@
1+
on:
2+
push:
3+
branches: [main]
4+
workflow_dispatch:
5+
inputs:
6+
head_sha:
7+
description: Commit SHA to test
8+
required: true
9+
type: string
10+
11+
jobs:
12+
reusable:
13+
permissions: {}
14+
uses: ./.github/workflows/cache_write_capable_reusable_workflow.yml
15+
with:
16+
head_sha: ${{ github.event.inputs.head_sha }}

‎actions/ql/test/query-tests/Security/CWE-349/CachePoisoningViaCodeInjection.expected‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -2,10 +2,12 @@ edges
22
| .github/workflows/code_injection2.yml:12:9:16:6 | Uses Step: modified_files | .github/workflows/code_injection2.yml:16:21:16:70 | steps.modified_files.outputs.files_modified | provenance | |
33
nodes
44
| .github/workflows/cache_write_capable_push.yml:10:21:10:59 | github.event.head_commit.message | semmle.label | github.event.head_commit.message |
5+
| .github/workflows/cache_write_capable_reusable_workflow.yml:45:21:45:59 | github.event.head_commit.message | semmle.label | github.event.head_commit.message |
56
| .github/workflows/code_injection1.yml:11:17:11:48 | github.event.comment.body | semmle.label | github.event.comment.body |
67
| .github/workflows/code_injection2.yml:12:9:16:6 | Uses Step: modified_files | semmle.label | Uses Step: modified_files |
78
| .github/workflows/code_injection2.yml:16:21:16:70 | steps.modified_files.outputs.files_modified | semmle.label | steps.modified_files.outputs.files_modified |
89
| .github/workflows/neg_code_injection1.yml:11:17:11:48 | github.event.comment.body | semmle.label | github.event.comment.body |
910
subpaths
1011
#select
1112
| .github/workflows/cache_write_capable_push.yml:10:21:10:59 | github.event.head_commit.message | .github/workflows/cache_write_capable_push.yml:10:21:10:59 | github.event.head_commit.message | .github/workflows/cache_write_capable_push.yml:10:21:10:59 | github.event.head_commit.message | Unprivileged code injection in $@, which may lead to cache poisoning ($@). | .github/workflows/cache_write_capable_push.yml:10:21:10:59 | github.event.head_commit.message | ${{ github.event.head_commit.message }} | .github/workflows/cache_write_capable_push.yml:2:3:2:6 | push | push |
13+
| .github/workflows/cache_write_capable_reusable_workflow.yml:45:21:45:59 | github.event.head_commit.message | .github/workflows/cache_write_capable_reusable_workflow.yml:45:21:45:59 | github.event.head_commit.message | .github/workflows/cache_write_capable_reusable_workflow.yml:45:21:45:59 | github.event.head_commit.message | Unprivileged code injection in $@, which may lead to cache poisoning ($@). | .github/workflows/cache_write_capable_reusable_workflow.yml:45:21:45:59 | github.event.head_commit.message | ${{ github.event.head_commit.message }} | .github/workflows/cache_write_capable_reusable_workflow_caller.yml:2:3:2:6 | push | push |

‎actions/ql/test/query-tests/Security/CWE-349/CachePoisoningViaDirectCache.expected‎

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1,4 +1,8 @@
11
edges
2+
| .github/workflows/cache_write_capable_reusable_workflow.yml:14:9:15:6 | Uses Step | .github/workflows/cache_write_capable_reusable_workflow.yml:15:9:21:6 | Run Step |
3+
| .github/workflows/cache_write_capable_reusable_workflow.yml:15:9:21:6 | Run Step | .github/workflows/cache_write_capable_reusable_workflow.yml:21:9:26:2 | Uses Step |
4+
| .github/workflows/cache_write_capable_reusable_workflow.yml:31:9:32:6 | Uses Step | .github/workflows/cache_write_capable_reusable_workflow.yml:32:9:38:6 | Run Step |
5+
| .github/workflows/cache_write_capable_reusable_workflow.yml:32:9:38:6 | Run Step | .github/workflows/cache_write_capable_reusable_workflow.yml:38:9:40:2 | Run Step |
26
| .github/workflows/cache_write_capable_workflow_dispatch.yml:14:9:15:6 | Uses Step | .github/workflows/cache_write_capable_workflow_dispatch.yml:15:9:21:6 | Run Step |
37
| .github/workflows/cache_write_capable_workflow_dispatch.yml:15:9:21:6 | Run Step | .github/workflows/cache_write_capable_workflow_dispatch.yml:21:9:22:6 | Run Step |
48
| .github/workflows/cache_write_capable_workflow_dispatch.yml:21:9:22:6 | Run Step | .github/workflows/cache_write_capable_workflow_dispatch.yml:22:9:25:33 | Uses Step |
@@ -47,4 +51,5 @@ edges
4751
| .github/workflows/poisonable_step5.yml:17:9:22:6 | Uses Step | .github/workflows/poisonable_step5.yml:22:9:24:6 | Uses Step |
4852
| .github/workflows/poisonable_step5.yml:22:9:24:6 | Uses Step | .github/workflows/poisonable_step5.yml:24:9:28:31 | Uses Step |
4953
#select
54+
| .github/workflows/cache_write_capable_reusable_workflow.yml:21:9:26:2 | Uses Step | .github/workflows/cache_write_capable_reusable_workflow.yml:15:9:21:6 | Run Step | .github/workflows/cache_write_capable_reusable_workflow.yml:21:9:26:2 | Uses Step | Potential cache poisoning in the context of the default branch due to privilege checkout of untrusted code. ($@). | .github/workflows/cache_write_capable_reusable_workflow_caller.yml:4:3:4:19 | workflow_dispatch | workflow_dispatch |
5055
| .github/workflows/cache_write_capable_workflow_dispatch.yml:22:9:25:33 | Uses Step | .github/workflows/cache_write_capable_workflow_dispatch.yml:15:9:21:6 | Run Step | .github/workflows/cache_write_capable_workflow_dispatch.yml:22:9:25:33 | Uses Step | Potential cache poisoning in the context of the default branch due to privilege checkout of untrusted code. ($@). | .github/workflows/cache_write_capable_workflow_dispatch.yml:2:3:2:19 | workflow_dispatch | workflow_dispatch |

‎actions/ql/test/query-tests/Security/CWE-349/CachePoisoningViaPoisonableStep.expected‎

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1,4 +1,8 @@
11
edges
2+
| .github/workflows/cache_write_capable_reusable_workflow.yml:14:9:15:6 | Uses Step | .github/workflows/cache_write_capable_reusable_workflow.yml:15:9:21:6 | Run Step |
3+
| .github/workflows/cache_write_capable_reusable_workflow.yml:15:9:21:6 | Run Step | .github/workflows/cache_write_capable_reusable_workflow.yml:21:9:26:2 | Uses Step |
4+
| .github/workflows/cache_write_capable_reusable_workflow.yml:31:9:32:6 | Uses Step | .github/workflows/cache_write_capable_reusable_workflow.yml:32:9:38:6 | Run Step |
5+
| .github/workflows/cache_write_capable_reusable_workflow.yml:32:9:38:6 | Run Step | .github/workflows/cache_write_capable_reusable_workflow.yml:38:9:40:2 | Run Step |
26
| .github/workflows/cache_write_capable_workflow_dispatch.yml:14:9:15:6 | Uses Step | .github/workflows/cache_write_capable_workflow_dispatch.yml:15:9:21:6 | Run Step |
37
| .github/workflows/cache_write_capable_workflow_dispatch.yml:15:9:21:6 | Run Step | .github/workflows/cache_write_capable_workflow_dispatch.yml:21:9:22:6 | Run Step |
48
| .github/workflows/cache_write_capable_workflow_dispatch.yml:21:9:22:6 | Run Step | .github/workflows/cache_write_capable_workflow_dispatch.yml:22:9:25:33 | Uses Step |
@@ -47,4 +51,5 @@ edges
4751
| .github/workflows/poisonable_step5.yml:17:9:22:6 | Uses Step | .github/workflows/poisonable_step5.yml:22:9:24:6 | Uses Step |
4852
| .github/workflows/poisonable_step5.yml:22:9:24:6 | Uses Step | .github/workflows/poisonable_step5.yml:24:9:28:31 | Uses Step |
4953
#select
54+
| .github/workflows/cache_write_capable_reusable_workflow.yml:38:9:40:2 | Run Step | .github/workflows/cache_write_capable_reusable_workflow.yml:32:9:38:6 | Run Step | .github/workflows/cache_write_capable_reusable_workflow.yml:38:9:40:2 | Run Step | Potential cache poisoning in the context of the default branch due to privilege checkout of untrusted code. ($@). | .github/workflows/cache_write_capable_reusable_workflow_caller.yml:4:3:4:19 | workflow_dispatch | workflow_dispatch |
5055
| .github/workflows/cache_write_capable_workflow_dispatch.yml:21:9:22:6 | Run Step | .github/workflows/cache_write_capable_workflow_dispatch.yml:15:9:21:6 | Run Step | .github/workflows/cache_write_capable_workflow_dispatch.yml:21:9:22:6 | Run Step | Potential cache poisoning in the context of the default branch due to privilege checkout of untrusted code. ($@). | .github/workflows/cache_write_capable_workflow_dispatch.yml:2:3:2:19 | workflow_dispatch | workflow_dispatch |

0 commit comments

Comments
 (0)