Preserve untrusted checkout alert coverage

Author: 1sgtpepper

actions/ql/lib/ext/config/poisonable_steps.yml

@@ -67,8 +67,8 @@ extensions:
       # TODO: It could also be in the form of `dir/cmd`
       - ["(\\.\\/[^\\s]+)\\b", 1] # eg: ./venv/bin/activate
       - ["(\\.\\s+[^\\s]+)\\b", 1] # eg: . venv/bin/activate
-      # An Actions expression may contain spaces while remaining one shell operand.
-      - ["(source|sh|bash|zsh|fish)\\s+((?:['\"]?\\$\\{\\{(?:[^}]|}(?!}))*+\\}\\}['\"]?[^\\s]*|[^\\s]+)\\b[\"']?)", 2]
+      # A workspace expression may contain spaces while remaining one shell operand.
+      - ["(source|sh|bash|zsh|fish)\\s+((?:['\"]?\\$\\{\\{\\s*github(?:\\.workspace|\\[\\s*'workspace'\\s*\\])\\s*\\}\\}['\"]?[^\\s]*|[^\\s]+)\\b[\"']?)", 2]
       - ["(node)\\s+([^\\s]+)(\\.js|\\.ts)\\b", 2]
       - ["(python[\\d\\.]*)\\s+([^\\s]+)\\.py\\b", 2]
       - ["(python[\\d\\.]*)\\s+-m\\s+([A-Za-z_][\\w\\.]*)\\b", 2] # eg: pythonX -m anything(dir or file)

actions/ql/src/Security/CWE-829/UntrustedCheckoutCritical.ql

@@ -45,11 +45,11 @@ bindingset[path]
 private predicate isWorkspaceContextExecutionPath(string path) {
   // Actions evaluates contexts before the resulting command is passed to the shell.
   path.regexpMatch([
-      "^\\$\\{\\{\\s*github\\.workspace\\s*\\}\\}/.*",
-      "^\"\\$\\{\\{\\s*github\\.workspace\\s*\\}\\}/.*\"$",
-      "^'\\$\\{\\{\\s*github\\.workspace\\s*\\}\\}/.*'$",
-      "^\"\\$\\{\\{\\s*github\\.workspace\\s*\\}\\}\"/.*",
-      "^'\\$\\{\\{\\s*github\\.workspace\\s*\\}\\}'/.*"
+      "^\\$\\{\\{\\s*github(?:\\.workspace|\\[\\s*'workspace'\\s*\\])\\s*\\}\\}/.*",
+      "^\"\\$\\{\\{\\s*github(?:\\.workspace|\\[\\s*'workspace'\\s*\\])\\s*\\}\\}/.*\"$",
+      "^'\\$\\{\\{\\s*github(?:\\.workspace|\\[\\s*'workspace'\\s*\\])\\s*\\}\\}/.*'$",
+      "^\"\\$\\{\\{\\s*github(?:\\.workspace|\\[\\s*'workspace'\\s*\\])\\s*\\}\\}\"/.*",
+      "^'\\$\\{\\{\\s*github(?:\\.workspace|\\[\\s*'workspace'\\s*\\])\\s*\\}\\}'/.*"
     ])
 }
 
@@ -63,7 +63,7 @@ private string normalizeWorkspaceExecutionPath(string path) {
   or
   isWorkspaceContextExecutionPath(path) and
   result =
-    path.regexpReplaceAll("^[\"']?\\$\\{\\{\\s*github\\.workspace\\s*\\}\\}[\"']?/",
+    path.regexpReplaceAll("^[\"']?\\$\\{\\{\\s*github(?:\\.workspace|\\[\\s*'workspace'\\s*\\])\\s*\\}\\}[\"']?/",
       "GITHUB_WORKSPACE/").regexpReplaceAll("[\"']$", "")
 }
 
@@ -155,11 +155,8 @@ where
     (
       // Check if the poisonable step is a local script execution step
       // and the path of the command or script matches the path of the downloaded artifact
-      // A shell assignment breaks the default-workspace provenance of the environment variable.
-      not (
-        isWorkspaceEnvironmentExecutionPath(poisonable.(LocalScriptExecutionRunStep).getRawPath()) and
-        poisonable.(LocalScriptExecutionRunStep).getScript().getAnAssignment("GITHUB_WORKSPACE", _)
-      ) and
+      // The shell model has no control-flow-sensitive assignment relation, so an assignment cannot
+      // safely disprove that the workspace value reaches this execution.
       checkoutContainsPath(checkout, poisonable.(LocalScriptExecutionRunStep).getRawPath(),
         poisonable.(LocalScriptExecutionRunStep).getPath())
       or

actions/ql/test/query-tests/Security/CWE-829/.github/workflows/untrusted_checkout_paths.yml

@@ -220,3 +220,59 @@ jobs:
       - run: bash ${{ github.workspace }}/candidate/../trusted.sh
       - run: bash ${{ github.workspace }}/../candidate/build.sh
       - run: bash ${{ github.action_path }}/candidate/build.sh
+
+  workspace-context-index-syntax:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4.2.2
+        with:
+          repository: ${{ github.event.pull_request.head.repo.full_name }}
+          ref: ${{ github.event.pull_request.head.sha }}
+          path: candidate
+      - run: bash "${{ github['workspace'] }}/candidate/build.sh"
+
+  unresolved-workspace-expression:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4.2.2
+        with:
+          repository: ${{ github.event.pull_request.head.repo.full_name }}
+          ref: ${{ github.event.pull_request.head.sha }}
+          path: candidate
+      - run: bash "${{ github.action_path }}/candidate/build.sh"
+
+  workspace-assignment-after-use:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4.2.2
+        with:
+          repository: ${{ github.event.pull_request.head.repo.full_name }}
+          ref: ${{ github.event.pull_request.head.sha }}
+          path: candidate
+      - run: |
+          bash "$GITHUB_WORKSPACE/candidate/build.sh"
+          GITHUB_WORKSPACE=/tmp
+
+  conditional-workspace-assignment:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4.2.2
+        with:
+          repository: ${{ github.event.pull_request.head.repo.full_name }}
+          ref: ${{ github.event.pull_request.head.sha }}
+          path: candidate
+      - run: |
+          if false; then
+            GITHUB_WORKSPACE=/tmp
+          fi
+          bash "$GITHUB_WORKSPACE/candidate/build.sh"
+
+  workspace-assignment-after-use-same-line:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4.2.2
+        with:
+          repository: ${{ github.event.pull_request.head.repo.full_name }}
+          ref: ${{ github.event.pull_request.head.sha }}
+          path: candidate
+      - run: bash $GITHUB_WORKSPACE/candidate/build.sh; GITHUB_WORKSPACE=/tmp

actions/ql/test/query-tests/Security/CWE-829/UntrustedCheckoutCritical.expected

@@ -378,7 +378,12 @@ edges
 | .github/workflows/untrusted_checkout_paths.yml:218:9:219:6 | Run Step | .github/workflows/untrusted_checkout_paths.yml:219:9:220:6 | Run Step |
 | .github/workflows/untrusted_checkout_paths.yml:219:9:220:6 | Run Step | .github/workflows/untrusted_checkout_paths.yml:220:9:221:6 | Run Step |
 | .github/workflows/untrusted_checkout_paths.yml:220:9:221:6 | Run Step | .github/workflows/untrusted_checkout_paths.yml:221:9:222:6 | Run Step |
-| .github/workflows/untrusted_checkout_paths.yml:221:9:222:6 | Run Step | .github/workflows/untrusted_checkout_paths.yml:222:9:222:63 | Run Step |
+| .github/workflows/untrusted_checkout_paths.yml:221:9:222:6 | Run Step | .github/workflows/untrusted_checkout_paths.yml:222:9:224:2 | Run Step |
+| .github/workflows/untrusted_checkout_paths.yml:227:9:232:6 | Uses Step | .github/workflows/untrusted_checkout_paths.yml:232:9:234:2 | Run Step |
+| .github/workflows/untrusted_checkout_paths.yml:237:9:242:6 | Uses Step | .github/workflows/untrusted_checkout_paths.yml:242:9:244:2 | Run Step |
+| .github/workflows/untrusted_checkout_paths.yml:247:9:252:6 | Uses Step | .github/workflows/untrusted_checkout_paths.yml:252:9:256:2 | Run Step |
+| .github/workflows/untrusted_checkout_paths.yml:259:9:264:6 | Uses Step | .github/workflows/untrusted_checkout_paths.yml:264:9:270:2 | Run Step |
+| .github/workflows/untrusted_checkout_paths.yml:273:9:278:6 | Uses Step | .github/workflows/untrusted_checkout_paths.yml:278:9:278:78 | Run Step |
 | .github/workflows/untrusted_checkout_permission_check_reusable2.yml:8:9:16:6 | Uses Step: checkAccess | .github/workflows/untrusted_checkout_permission_check_reusable2.yml:16:9:22:2 | Run Step |
 | .github/workflows/untrusted_checkout_permission_check_reusable.yml:8:9:16:6 | Uses Step: checkAccess | .github/workflows/untrusted_checkout_permission_check_reusable.yml:16:9:22:2 | Run Step |
 | .github/workflows/untrusted_checkout_permission_check_reusable_level2.yml:8:9:16:6 | Uses Step: checkAccess | .github/workflows/untrusted_checkout_permission_check_reusable_level2.yml:16:9:22:2 | Run Step |
@@ -452,10 +457,15 @@ edges
 | .github/workflows/untrusted_checkout_paths.yml:193:9:198:6 | Uses Step | .github/workflows/untrusted_checkout_paths.yml:193:9:198:6 | Uses Step | .github/workflows/untrusted_checkout_paths.yml:207:9:208:6 | Run Step | Checkout of untrusted code in a privileged workflow with later potential execution (event trigger: $@). | .github/workflows/untrusted_checkout_paths.yml:4:3:4:21 | pull_request_target | pull_request_target |
 | .github/workflows/untrusted_checkout_paths.yml:193:9:198:6 | Uses Step | .github/workflows/untrusted_checkout_paths.yml:193:9:198:6 | Uses Step | .github/workflows/untrusted_checkout_paths.yml:208:9:209:6 | Run Step | Checkout of untrusted code in a privileged workflow with later potential execution (event trigger: $@). | .github/workflows/untrusted_checkout_paths.yml:4:3:4:21 | pull_request_target | pull_request_target |
 | .github/workflows/untrusted_checkout_paths.yml:193:9:198:6 | Uses Step | .github/workflows/untrusted_checkout_paths.yml:193:9:198:6 | Uses Step | .github/workflows/untrusted_checkout_paths.yml:209:9:210:6 | Run Step | Checkout of untrusted code in a privileged workflow with later potential execution (event trigger: $@). | .github/workflows/untrusted_checkout_paths.yml:4:3:4:21 | pull_request_target | pull_request_target |
+| .github/workflows/untrusted_checkout_paths.yml:193:9:198:6 | Uses Step | .github/workflows/untrusted_checkout_paths.yml:193:9:198:6 | Uses Step | .github/workflows/untrusted_checkout_paths.yml:211:9:214:6 | Run Step | Checkout of untrusted code in a privileged workflow with later potential execution (event trigger: $@). | .github/workflows/untrusted_checkout_paths.yml:4:3:4:21 | pull_request_target | pull_request_target |
 | .github/workflows/untrusted_checkout_paths.yml:193:9:198:6 | Uses Step | .github/workflows/untrusted_checkout_paths.yml:193:9:198:6 | Uses Step | .github/workflows/untrusted_checkout_paths.yml:214:9:215:6 | Run Step | Checkout of untrusted code in a privileged workflow with later potential execution (event trigger: $@). | .github/workflows/untrusted_checkout_paths.yml:4:3:4:21 | pull_request_target | pull_request_target |
 | .github/workflows/untrusted_checkout_paths.yml:193:9:198:6 | Uses Step | .github/workflows/untrusted_checkout_paths.yml:193:9:198:6 | Uses Step | .github/workflows/untrusted_checkout_paths.yml:215:9:216:6 | Run Step | Checkout of untrusted code in a privileged workflow with later potential execution (event trigger: $@). | .github/workflows/untrusted_checkout_paths.yml:4:3:4:21 | pull_request_target | pull_request_target |
 | .github/workflows/untrusted_checkout_paths.yml:193:9:198:6 | Uses Step | .github/workflows/untrusted_checkout_paths.yml:193:9:198:6 | Uses Step | .github/workflows/untrusted_checkout_paths.yml:216:9:217:6 | Run Step | Checkout of untrusted code in a privileged workflow with later potential execution (event trigger: $@). | .github/workflows/untrusted_checkout_paths.yml:4:3:4:21 | pull_request_target | pull_request_target |
 | .github/workflows/untrusted_checkout_paths.yml:193:9:198:6 | Uses Step | .github/workflows/untrusted_checkout_paths.yml:193:9:198:6 | Uses Step | .github/workflows/untrusted_checkout_paths.yml:217:9:218:6 | Run Step | Checkout of untrusted code in a privileged workflow with later potential execution (event trigger: $@). | .github/workflows/untrusted_checkout_paths.yml:4:3:4:21 | pull_request_target | pull_request_target |
 | .github/workflows/untrusted_checkout_paths.yml:193:9:198:6 | Uses Step | .github/workflows/untrusted_checkout_paths.yml:193:9:198:6 | Uses Step | .github/workflows/untrusted_checkout_paths.yml:218:9:219:6 | Run Step | Checkout of untrusted code in a privileged workflow with later potential execution (event trigger: $@). | .github/workflows/untrusted_checkout_paths.yml:4:3:4:21 | pull_request_target | pull_request_target |
+| .github/workflows/untrusted_checkout_paths.yml:227:9:232:6 | Uses Step | .github/workflows/untrusted_checkout_paths.yml:227:9:232:6 | Uses Step | .github/workflows/untrusted_checkout_paths.yml:232:9:234:2 | Run Step | Checkout of untrusted code in a privileged workflow with later potential execution (event trigger: $@). | .github/workflows/untrusted_checkout_paths.yml:4:3:4:21 | pull_request_target | pull_request_target |
+| .github/workflows/untrusted_checkout_paths.yml:247:9:252:6 | Uses Step | .github/workflows/untrusted_checkout_paths.yml:247:9:252:6 | Uses Step | .github/workflows/untrusted_checkout_paths.yml:252:9:256:2 | Run Step | Checkout of untrusted code in a privileged workflow with later potential execution (event trigger: $@). | .github/workflows/untrusted_checkout_paths.yml:4:3:4:21 | pull_request_target | pull_request_target |
+| .github/workflows/untrusted_checkout_paths.yml:259:9:264:6 | Uses Step | .github/workflows/untrusted_checkout_paths.yml:259:9:264:6 | Uses Step | .github/workflows/untrusted_checkout_paths.yml:264:9:270:2 | Run Step | Checkout of untrusted code in a privileged workflow with later potential execution (event trigger: $@). | .github/workflows/untrusted_checkout_paths.yml:4:3:4:21 | pull_request_target | pull_request_target |
+| .github/workflows/untrusted_checkout_paths.yml:273:9:278:6 | Uses Step | .github/workflows/untrusted_checkout_paths.yml:273:9:278:6 | Uses Step | .github/workflows/untrusted_checkout_paths.yml:278:9:278:78 | Run Step | Checkout of untrusted code in a privileged workflow with later potential execution (event trigger: $@). | .github/workflows/untrusted_checkout_paths.yml:4:3:4:21 | pull_request_target | pull_request_target |
 | .github/workflows/untrusted_checkout_permissions_check.yml:36:9:41:6 | Uses Step | .github/workflows/untrusted_checkout_permissions_check.yml:36:9:41:6 | Uses Step | .github/workflows/untrusted_checkout_permissions_check.yml:41:9:41:22 | Run Step | Checkout of untrusted code in a privileged workflow with later potential execution (event trigger: $@). | .github/workflows/untrusted_checkout_permissions_check.yml:2:3:2:21 | pull_request_target | pull_request_target |
 | .github/workflows/workflow_run_untrusted_checkout_path.yml:12:9:16:6 | Uses Step | .github/workflows/workflow_run_untrusted_checkout_path.yml:12:9:16:6 | Uses Step | .github/workflows/workflow_run_untrusted_checkout_path.yml:16:9:16:40 | Run Step | Checkout of untrusted code in a privileged workflow with later potential execution (event trigger: $@). | .github/workflows/workflow_run_untrusted_checkout_path.yml:4:3:4:14 | workflow_run | workflow_run |

actions/ql/test/query-tests/Security/CWE-829/UntrustedCheckoutHigh.expected

@@ -17,6 +17,7 @@
 | .github/workflows/pr-workflow.yml:444:9:449:6 | Uses Step | Checkout of untrusted code in a privileged workflow with later potential execution (event trigger: $@). | .github/workflows/pr-workflow-fork.yaml:7:3:7:21 | pull_request_target | pull_request_target |
 | .github/workflows/test13.yml:20:7:25:4 | Uses Step | Checkout of untrusted code in a privileged workflow with later potential execution (event trigger: $@). | .github/workflows/test13.yml:2:3:2:15 | issue_comment | issue_comment |
 | .github/workflows/untrusted_checkout2.yml:14:9:19:72 | Run Step | Checkout of untrusted code in a privileged workflow with later potential execution (event trigger: $@). | .github/workflows/untrusted_checkout2.yml:1:5:1:17 | issue_comment | issue_comment |
+| .github/workflows/untrusted_checkout_paths.yml:237:9:242:6 | Uses Step | Checkout of untrusted code in a privileged workflow with later potential execution (event trigger: $@). | .github/workflows/untrusted_checkout_paths.yml:4:3:4:21 | pull_request_target | pull_request_target |
 | .github/workflows/workflow_run_untrusted_checkout.yml:13:9:16:6 | Uses Step | Checkout of untrusted code in a privileged workflow with later potential execution (event trigger: $@). | .github/workflows/workflow_run_untrusted_checkout.yml:2:3:2:14 | workflow_run | workflow_run |
 | .github/workflows/workflow_run_untrusted_checkout.yml:16:9:18:31 | Uses Step | Checkout of untrusted code in a privileged workflow with later potential execution (event trigger: $@). | .github/workflows/workflow_run_untrusted_checkout.yml:2:3:2:14 | workflow_run | workflow_run |
 | .github/workflows/workflow_run_untrusted_checkout_2.yml:13:9:16:6 | Uses Step | Checkout of untrusted code in a privileged workflow with later potential execution (event trigger: $@). | .github/workflows/workflow_run_untrusted_checkout_2.yml:2:3:2:14 | workflow_run | workflow_run |