Skip to content

Commit fd0aadf

Browse files
redsun82redsun82
authored
Merge branch 'main' into redsun82/cargo-upgrade
2 parents 9390fe2 + 02249af commit fd0aadf

File tree

231 files changed

+1591
-513
lines changed

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

231 files changed

+1591
-513
lines changed

‎actions/ql/lib/CHANGELOG.md

+6
Original file line numberDiff line numberDiff line change
@@ -1,3 +1,9 @@
1+
## 0.4.3
2+
3+
### New Features
4+
5+
* The "Unpinned tag for a non-immutable Action in workflow" query (`actions/unpinned-tag`) now supports expanding the trusted action owner list using data extensions (`extensible: trustedActionsOwnerDataModel`). If you trust an Action publisher, you can include the owner name/organization in a model pack to add it to the allow list for this query. This addition will prevent security alerts when using unpinned tags for Actions published by that owner. For more information on creating a model pack, see [Creating a CodeQL Model Pack](https://docs.github.com/en/code-security/codeql-cli/using-the-advanced-functionality-of-the-codeql-cli/creating-and-working-with-codeql-packs#creating-a-codeql-model-pack).
6+
17
## 0.4.2
28

39
### Bug Fixes

‎actions/ql/lib/change-notes/2025-01-07-trusted-owner-ext.md ‎actions/ql/lib/change-notes/released/0.4.3.md

+5-4
Original file line numberDiff line numberDiff line change
@@ -1,4 +1,5 @@
1-
---
2-
category: feature
3-
---
4-
* The "Unpinned tag for a non-immutable Action in workflow" query (`actions/unpinned-tag`) now supports expanding the trusted action owner list using data extensions (`extensible: trustedActionsOwnerDataModel`). If you trust an Action publisher, you can include the owner name/organization in a model pack to add it to the allow list for this query. This addition will prevent security alerts when using unpinned tags for Actions published by that owner. For more information on creating a model pack, see [Creating a CodeQL Model Pack](https://docs.github.com/en/code-security/codeql-cli/using-the-advanced-functionality-of-the-codeql-cli/creating-and-working-with-codeql-packs#creating-a-codeql-model-pack).
1+
## 0.4.3
2+
3+
### New Features
4+
5+
* The "Unpinned tag for a non-immutable Action in workflow" query (`actions/unpinned-tag`) now supports expanding the trusted action owner list using data extensions (`extensible: trustedActionsOwnerDataModel`). If you trust an Action publisher, you can include the owner name/organization in a model pack to add it to the allow list for this query. This addition will prevent security alerts when using unpinned tags for Actions published by that owner. For more information on creating a model pack, see [Creating a CodeQL Model Pack](https://docs.github.com/en/code-security/codeql-cli/using-the-advanced-functionality-of-the-codeql-cli/creating-and-working-with-codeql-packs#creating-a-codeql-model-pack).

‎actions/ql/lib/codeql-pack.release.yml

+1-1
Original file line numberDiff line numberDiff line change
@@ -1,2 +1,2 @@
11
---
2-
lastReleaseVersion: 0.4.2
2+
lastReleaseVersion: 0.4.3

‎actions/ql/lib/qlpack.yml

+1-1
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,5 @@
11
name: codeql/actions-all
2-
version: 0.4.3-dev
2+
version: 0.4.4-dev
33
library: true
44
warnOnImplicitThis: true
55
dependencies:

‎actions/ql/src/CHANGELOG.md

+26
Original file line numberDiff line numberDiff line change
@@ -1,3 +1,29 @@
1+
## 0.5.0
2+
3+
### Breaking Changes
4+
5+
* The following queries have been removed from the `code-scanning` and `security-extended` suites.
6+
Any existing alerts for these queries will be closed automatically.
7+
* `actions/if-expression-always-true/critical`
8+
* `actions/if-expression-always-true/high`
9+
* `actions/unnecessary-use-of-advanced-config`
10+
11+
* The following query has been moved from the `code-scanning` suite to the `security-extended`
12+
suite. Any existing alerts for this query will be closed automatically unless the analysis is
13+
configured to use the `security-extended` suite.
14+
* `actions/unpinned-tag`
15+
* The following queries have been added to the `security-extended` suite.
16+
* `actions/unversioned-immutable-action`
17+
* `actions/envpath-injection/medium`
18+
* `actions/envvar-injection/medium`
19+
* `actions/code-injection/medium`
20+
* `actions/artifact-poisoning/medium`
21+
* `actions/untrusted-checkout/medium`
22+
23+
### Minor Analysis Improvements
24+
25+
* Fixed false positives in the query `actions/unpinned-tag` (CWE-829), which will no longer flag uses of Docker-based GitHub actions pinned by the container's SHA256 digest.
26+
127
## 0.4.2
228

329
No user-facing changes.

‎actions/ql/src/Security/CWE-829/UnpinnedActionsTag.ql

+9-1
Original file line numberDiff line numberDiff line change
@@ -23,6 +23,14 @@ private predicate isTrustedOwner(string nwo) {
2323
trustedActionsOwnerDataModel(nwo.substring(0, nwo.indexOf("/")))
2424
}
2525

26+
bindingset[version]
27+
private predicate isPinnedContainer(string version) {
28+
version.regexpMatch("^sha256:[A-Fa-f0-9]{64}$")
29+
}
30+
31+
bindingset[nwo]
32+
private predicate isContainerImage(string nwo) { nwo.regexpMatch("^docker://.+") }
33+
2634
from UsesStep uses, string nwo, string version, Workflow workflow, string name
2735
where
2836
uses.getCallee() = nwo and
@@ -34,7 +42,7 @@ where
3442
) and
3543
uses.getVersion() = version and
3644
not isTrustedOwner(nwo) and
37-
not isPinnedCommit(version) and
45+
not (if isContainerImage(nwo) then isPinnedContainer(version) else isPinnedCommit(version)) and
3846
not isImmutableAction(uses, nwo)
3947
select uses.getCalleeNode(),
4048
"Unpinned 3rd party Action '" + name + "' step $@ uses '" + nwo + "' with ref '" + version +

‎actions/ql/src/change-notes/2025-02-06-curate-suites.md ‎actions/ql/src/change-notes/released/0.5.0.md

+8-3
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,7 @@
1-
---
2-
category: breaking
3-
---
1+
## 0.5.0
2+
3+
### Breaking Changes
4+
45
* The following queries have been removed from the `code-scanning` and `security-extended` suites.
56
Any existing alerts for these queries will be closed automatically.
67
* `actions/if-expression-always-true/critical`
@@ -18,3 +19,7 @@ category: breaking
1819
* `actions/code-injection/medium`
1920
* `actions/artifact-poisoning/medium`
2021
* `actions/untrusted-checkout/medium`
22+
23+
### Minor Analysis Improvements
24+
25+
* Fixed false positives in the query `actions/unpinned-tag` (CWE-829), which will no longer flag uses of Docker-based GitHub actions pinned by the container's SHA256 digest.

‎actions/ql/src/codeql-pack.release.yml

+1-1
Original file line numberDiff line numberDiff line change
@@ -1,2 +1,2 @@
11
---
2-
lastReleaseVersion: 0.4.2
2+
lastReleaseVersion: 0.5.0

‎actions/ql/src/qlpack.yml

+1-1
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,5 @@
11
name: codeql/actions-queries
2-
version: 0.4.3-dev
2+
version: 0.5.1-dev
33
library: false
44
warnOnImplicitThis: true
55
groups: [actions, queries]

‎actions/ql/test/query-tests/Security/CWE-829/.github/workflows/unpinned_tags.yml

+2
Original file line numberDiff line numberDiff line change
@@ -9,3 +9,5 @@ jobs:
99
- uses: foo/bar
1010
- uses: foo/bar@v1
1111
- uses: foo/bar@25b062c917b0c75f8b47d8469aff6c94ffd89abb
12+
- uses: docker://foo/bar@latest
13+
- uses: docker://foo/bar@sha256:887a259a5a534f3c4f36cb02dca341673c6089431057242cdc931e9f133147e9

‎actions/ql/test/query-tests/Security/CWE-829/UnpinnedActionsTag.expected

+1
Original file line numberDiff line numberDiff line change
@@ -32,3 +32,4 @@
3232
| .github/workflows/test17.yml:20:21:20:63 | sonarsource/sonarcloud-github-action@master | Unpinned 3rd party Action 'Sonar' step $@ uses 'sonarsource/sonarcloud-github-action' with ref 'master', not a pinned commit hash | .github/workflows/test17.yml:19:15:23:58 | Uses Step | Uses Step |
3333
| .github/workflows/test18.yml:37:21:37:63 | sonarsource/sonarcloud-github-action@master | Unpinned 3rd party Action 'Sonar' step $@ uses 'sonarsource/sonarcloud-github-action' with ref 'master', not a pinned commit hash | .github/workflows/test18.yml:36:15:40:58 | Uses Step | Uses Step |
3434
| .github/workflows/unpinned_tags.yml:10:13:10:22 | foo/bar@v1 | Unpinned 3rd party Action 'unpinned_tags.yml' step $@ uses 'foo/bar' with ref 'v1', not a pinned commit hash | .github/workflows/unpinned_tags.yml:10:7:11:4 | Uses Step | Uses Step |
35+
| .github/workflows/unpinned_tags.yml:12:13:12:35 | docker://foo/bar@latest | Unpinned 3rd party Action 'unpinned_tags.yml' step $@ uses 'docker://foo/bar' with ref 'latest', not a pinned commit hash | .github/workflows/unpinned_tags.yml:12:7:13:4 | Uses Step | Uses Step |

‎actions/ql/test/query-tests/Security/CWE-829/UntrustedCheckoutCritical.expected

+3-1
Original file line numberDiff line numberDiff line change
@@ -299,7 +299,9 @@ edges
299299
| .github/workflows/test.yml:14:9:25:6 | Run Step | .github/workflows/test.yml:25:9:33:6 | Run Step |
300300
| .github/workflows/test.yml:25:9:33:6 | Run Step | .github/workflows/test.yml:33:9:37:34 | Run Step |
301301
| .github/workflows/unpinned_tags.yml:9:7:10:4 | Uses Step | .github/workflows/unpinned_tags.yml:10:7:11:4 | Uses Step |
302-
| .github/workflows/unpinned_tags.yml:10:7:11:4 | Uses Step | .github/workflows/unpinned_tags.yml:11:7:11:61 | Uses Step |
302+
| .github/workflows/unpinned_tags.yml:10:7:11:4 | Uses Step | .github/workflows/unpinned_tags.yml:11:7:12:4 | Uses Step |
303+
| .github/workflows/unpinned_tags.yml:11:7:12:4 | Uses Step | .github/workflows/unpinned_tags.yml:12:7:13:4 | Uses Step |
304+
| .github/workflows/unpinned_tags.yml:12:7:13:4 | Uses Step | .github/workflows/unpinned_tags.yml:13:7:13:101 | Uses Step |
303305
| .github/workflows/untrusted_checkout2.yml:7:9:14:6 | Run Step: pr_number | .github/workflows/untrusted_checkout2.yml:14:9:19:72 | Run Step |
304306
| .github/workflows/untrusted_checkout3.yml:11:9:12:6 | Uses Step | .github/workflows/untrusted_checkout3.yml:12:9:13:6 | Uses Step |
305307
| .github/workflows/untrusted_checkout3.yml:12:9:13:6 | Uses Step | .github/actions/dangerous-git-checkout/action.yml:6:7:11:4 | Uses Step |

‎cpp/ql/lib/CHANGELOG.md

+4
Original file line numberDiff line numberDiff line change
@@ -1,3 +1,7 @@
1+
## 4.0.1
2+
3+
No user-facing changes.
4+
15
## 4.0.0
26

37
### Breaking Changes

‎cpp/ql/lib/change-notes/released/4.0.1.md

+3
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,3 @@
1+
## 4.0.1
2+
3+
No user-facing changes.

‎cpp/ql/lib/codeql-pack.release.yml

+1-1
Original file line numberDiff line numberDiff line change
@@ -1,2 +1,2 @@
11
---
2-
lastReleaseVersion: 4.0.0
2+
lastReleaseVersion: 4.0.1

‎cpp/ql/lib/qlpack.yml

+1-1
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,5 @@
11
name: codeql/cpp-all
2-
version: 4.0.1-dev
2+
version: 4.0.2-dev
33
groups: cpp
44
dbscheme: semmlecode.cpp.dbscheme
55
extractor: cpp

‎cpp/ql/src/CHANGELOG.md

+4
Original file line numberDiff line numberDiff line change
@@ -1,3 +1,7 @@
1+
## 1.3.4
2+
3+
No user-facing changes.
4+
15
## 1.3.3
26

37
### Minor Analysis Improvements

‎cpp/ql/src/change-notes/released/1.3.4.md

+3
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,3 @@
1+
## 1.3.4
2+
3+
No user-facing changes.

‎cpp/ql/src/codeql-pack.release.yml

+1-1
Original file line numberDiff line numberDiff line change
@@ -1,2 +1,2 @@
11
---
2-
lastReleaseVersion: 1.3.3
2+
lastReleaseVersion: 1.3.4

‎cpp/ql/src/qlpack.yml

+1-1
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,5 @@
11
name: codeql/cpp-queries
2-
version: 1.3.4-dev
2+
version: 1.3.5-dev
33
groups:
44
- cpp
55
- queries

‎csharp/ql/campaigns/Solorigate/lib/CHANGELOG.md

+4
Original file line numberDiff line numberDiff line change
@@ -1,3 +1,7 @@
1+
## 1.7.34
2+
3+
No user-facing changes.
4+
15
## 1.7.33
26

37
No user-facing changes.

‎csharp/ql/campaigns/Solorigate/lib/change-notes/released/1.7.34.md

+3
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,3 @@
1+
## 1.7.34
2+
3+
No user-facing changes.

‎csharp/ql/campaigns/Solorigate/lib/codeql-pack.release.yml

+1-1
Original file line numberDiff line numberDiff line change
@@ -1,2 +1,2 @@
11
---
2-
lastReleaseVersion: 1.7.33
2+
lastReleaseVersion: 1.7.34

‎csharp/ql/campaigns/Solorigate/lib/qlpack.yml

+1-1
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,5 @@
11
name: codeql/csharp-solorigate-all
2-
version: 1.7.34-dev
2+
version: 1.7.35-dev
33
groups:
44
- csharp
55
- solorigate

‎csharp/ql/campaigns/Solorigate/src/CHANGELOG.md

+4
Original file line numberDiff line numberDiff line change
@@ -1,3 +1,7 @@
1+
## 1.7.34
2+
3+
No user-facing changes.
4+
15
## 1.7.33
26

37
No user-facing changes.

‎csharp/ql/campaigns/Solorigate/src/change-notes/released/1.7.34.md

+3
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,3 @@
1+
## 1.7.34
2+
3+
No user-facing changes.

‎csharp/ql/campaigns/Solorigate/src/codeql-pack.release.yml

+1-1
Original file line numberDiff line numberDiff line change
@@ -1,2 +1,2 @@
11
---
2-
lastReleaseVersion: 1.7.33
2+
lastReleaseVersion: 1.7.34

‎csharp/ql/campaigns/Solorigate/src/qlpack.yml

+1-1
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,5 @@
11
name: codeql/csharp-solorigate-queries
2-
version: 1.7.34-dev
2+
version: 1.7.35-dev
33
groups:
44
- csharp
55
- solorigate

‎csharp/ql/lib/CHANGELOG.md

+15
Original file line numberDiff line numberDiff line change
@@ -1,3 +1,18 @@
1+
## 5.1.0
2+
3+
### Deprecated APIs
4+
5+
* The predicates `immediatelyControls` and `controls` on the `ConditionBlock`
6+
class have been deprecated in favor of the newly added `dominatingEdge`
7+
predicate.
8+
9+
### Minor Analysis Improvements
10+
11+
* Full support for C# 13 / .NET 9. All new language features are now supported by the extractor. QL library and data flow support for the new C# 13 language constructs and generated MaD models for the .NET 9 runtime.
12+
* C# 13: Add generated models for .NET 9.
13+
* The models for `System.Net.Http.HttpRequestMessage` and `System.UriBuilder` have been modified to better model the flow of tainted URIs.
14+
* Blazor `[Parameter]` fields bound to a variable from the route specified in the `@page` directive are now modeled as remote flow sources.
15+
116
## 5.0.0
217

318
### Breaking Changes

‎csharp/ql/lib/change-notes/2025-02-03-blazor-routing-parameters.md

-4
This file was deleted.

‎csharp/ql/lib/change-notes/2025-02-05-update-system.net.http.httprequestmessage-and-system.uribuilder-models.md

-4
This file was deleted.

‎csharp/ql/lib/change-notes/2025-02-07-dotnet-models.md

-5
This file was deleted.

‎csharp/ql/lib/change-notes/2025-02-13-csharp13-dotnet9.md

-4
This file was deleted.

‎csharp/ql/lib/change-notes/released/5.1.0.md

+14
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,14 @@
1+
## 5.1.0
2+
3+
### Deprecated APIs
4+
5+
* The predicates `immediatelyControls` and `controls` on the `ConditionBlock`
6+
class have been deprecated in favor of the newly added `dominatingEdge`
7+
predicate.
8+
9+
### Minor Analysis Improvements
10+
11+
* Full support for C# 13 / .NET 9. All new language features are now supported by the extractor. QL library and data flow support for the new C# 13 language constructs and generated MaD models for the .NET 9 runtime.
12+
* C# 13: Add generated models for .NET 9.
13+
* The models for `System.Net.Http.HttpRequestMessage` and `System.UriBuilder` have been modified to better model the flow of tainted URIs.
14+
* Blazor `[Parameter]` fields bound to a variable from the route specified in the `@page` directive are now modeled as remote flow sources.

‎csharp/ql/lib/codeql-pack.release.yml

+1-1
Original file line numberDiff line numberDiff line change
@@ -1,2 +1,2 @@
11
---
2-
lastReleaseVersion: 5.0.0
2+
lastReleaseVersion: 5.1.0

‎csharp/ql/lib/qlpack.yml

+1-1
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,5 @@
11
name: codeql/csharp-all
2-
version: 5.0.1-dev
2+
version: 5.1.1-dev
33
groups: csharp
44
dbscheme: semmlecode.csharp.dbscheme
55
extractor: csharp

‎csharp/ql/src/CHANGELOG.md

+4
Original file line numberDiff line numberDiff line change
@@ -1,3 +1,7 @@
1+
## 1.0.17
2+
3+
No user-facing changes.
4+
15
## 1.0.16
26

37
### Minor Analysis Improvements

‎csharp/ql/src/change-notes/released/1.0.17.md

+3
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,3 @@
1+
## 1.0.17
2+
3+
No user-facing changes.

‎csharp/ql/src/codeql-pack.release.yml

+1-1
Original file line numberDiff line numberDiff line change
@@ -1,2 +1,2 @@
11
---
2-
lastReleaseVersion: 1.0.16
2+
lastReleaseVersion: 1.0.17

‎csharp/ql/src/qlpack.yml

+1-1
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,5 @@
11
name: codeql/csharp-queries
2-
version: 1.0.17-dev
2+
version: 1.0.18-dev
33
groups:
44
- csharp
55
- queries

0 commit comments

Comments
 (0)