Skip to content

Commit 166baa1

Browse files
data-douserdata-douser
authored
Merge branch 'main' into dd/paths-ignore/1
2 parents 055c579 + deb8392 commit 166baa1

File tree

44 files changed

+438
-269
lines changed

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

44 files changed

+438
-269
lines changed

‎.github/codeql/codeql-config.yaml‎

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -6,5 +6,11 @@ queries:
66
- uses: ./javascript/frameworks/cap/src/codeql-suites/javascript-security-extended.qls
77
- uses: ./javascript/frameworks/xsjs/src/codeql-suites/javascript-security-extended.qls
88

9+
packs:
10+
javascript:
11+
- advanced-security/javascript-sap-ui5-models
12+
- advanced-security/javascript-sap-cap-models
13+
- advanced-security/javascript-sap-xsjs-models
14+
915
paths-ignore:
1016
- "**/frameworks/*/test/models"

‎.github/workflows/code_scanning.yml‎

Lines changed: 65 additions & 73 deletions
Original file line numberDiff line numberDiff line change
@@ -2,12 +2,12 @@ name: "Code Scanning"
22

33
on:
44
push:
5-
branches: [ "main" ]
5+
branches: ["main"]
66
pull_request:
77
# The branches below must be a subset of the branches above
8-
branches: [ "main" ]
8+
branches: ["main"]
99
schedule:
10-
- cron: '39 12 * * 2'
10+
- cron: "39 12 * * 2"
1111
workflow_dispatch:
1212

1313
permissions:
@@ -19,88 +19,80 @@ env:
1919
jobs:
2020
analyze-javascript:
2121
name: Analyze
22-
runs-on: 'ubuntu-latest'
22+
runs-on: "ubuntu-latest"
2323
permissions:
2424
actions: read
2525
contents: read
2626
security-events: write
2727

2828
steps:
29-
- name: Checkout repository
30-
uses: actions/checkout@v6
29+
- name: Checkout repository
30+
uses: actions/checkout@v6
3131

32-
- name: Prepare local CodeQL model packs
33-
run: |
34-
mkdir -p .github/codeql/extensions
35-
for ext in $(find . -name 'qlpack.yml' -exec fgrep -l dataExtensions {} \;); do
36-
dir=$(dirname $ext)
37-
echo "Moving $ext to .github/codeql/extensions/$dir"
38-
mkdir -p .github/codeql/extensions/$dir
39-
mv $dir .github/codeql/extensions/$dir
40-
done
32+
- name: Extract CodeQL bundle version from qlt.conf.json
33+
run: |
34+
echo "BUNDLE_VERSION=$(jq .CodeQLCLIBundle qlt.conf.json -r)" >> $GITHUB_ENV
4135
42-
- name: Extract CodeQL bundle version from qlt.conf.json
43-
run: |
44-
echo "BUNDLE_VERSION=$(jq .CodeQLCLIBundle qlt.conf.json -r)" >> $GITHUB_ENV
36+
- name: Initialize CodeQL
37+
id: initialize-codeql
38+
uses: github/codeql-action/init@v4
39+
env:
40+
# Add our custom extractor to the CodeQL search path
41+
CODEQL_ACTION_EXTRA_OPTIONS: '{"database":{"init":["--search-path","${{ github.workspace }}/extractors:${{ github.workspace }}"]}}'
42+
with:
43+
languages: javascript
44+
config-file: ./.github/codeql/codeql-config.yaml
45+
db-location: ${{ runner.temp }}/codeql-database
46+
tools: https://github.com/github/codeql-action/releases/download/${{env.BUNDLE_VERSION}}/codeql-bundle-linux64.tar.gz
47+
debug: true
4548

46-
- name: Initialize CodeQL
47-
id: initialize-codeql
48-
uses: github/codeql-action/init@v4
49-
env:
50-
# Add our custom extractor to the CodeQL search path
51-
CODEQL_ACTION_EXTRA_OPTIONS: '{"database":{"init":["--search-path","${{ github.workspace }}/extractors"]}}'
52-
with:
53-
languages: javascript
54-
config-file: ./.github/codeql/codeql-config.yaml
55-
db-location: ${{ runner.temp }}/codeql-database
56-
tools: https://github.com/github/codeql-action/releases/download/${{env.BUNDLE_VERSION}}/codeql-bundle-linux64.tar.gz
57-
debug: true
49+
- name: Run CDS extractor
50+
shell: bash
51+
run: |
52+
export CODEQL_DIST="$(dirname "${{ steps.initialize-codeql.outputs.codeql-path }}")"
53+
export CODEQL_EXTRACTOR_JAVASCRIPT_WIP_DATABASE="${{ runner.temp }}/codeql-database/javascript"
54+
${{ github.workspace }}/scripts/compile-cds.sh
5855
59-
- name: Run CDS extractor
60-
shell: bash
61-
run: |
62-
export CODEQL_DIST="$(dirname "${{ steps.initialize-codeql.outputs.codeql-path }}")"
63-
export CODEQL_EXTRACTOR_JAVASCRIPT_WIP_DATABASE="${{ runner.temp }}/codeql-database/javascript"
64-
${{ github.workspace }}/scripts/compile-cds.sh
56+
- name: Perform CodeQL Analysis
57+
id: analyze
58+
uses: github/codeql-action/analyze@v4
59+
env:
60+
LGTM_INDEX_XML_MODE: all
61+
LGTM_INDEX_FILETYPES: ".json:JSON"
62+
# Add our CodeQL workspace to the path to search for packs to then resolve the MaD locally
63+
CODEQL_ACTION_EXTRA_OPTIONS: '{"database":{"run-queries":["--additional-packs","${{ github.workspace }}/javascript/frameworks/xsjs/ext:${{ github.workspace }}/javascript/frameworks/cap/ext:${{ github.workspace }}/javascript/frameworks/ui5/ext"],"interpret-results":["--additional-packs","${{ github.workspace }}/javascript/frameworks/xsjs/ext:${{ github.workspace }}/javascript/frameworks/cap/ext:${{ github.workspace }}/javascript/frameworks/ui5/ext"]}}'
6564

66-
- name: Perform CodeQL Analysis
67-
id: analyze
68-
uses: github/codeql-action/analyze@v4
69-
env:
70-
LGTM_INDEX_XML_MODE: all
71-
LGTM_INDEX_FILETYPES: ".json:JSON"
65+
- name: Setup Python
66+
uses: actions/setup-python@v5
67+
with:
68+
python-version: "3.10"
7269

73-
- name: Setup Python
74-
uses: actions/setup-python@v5
75-
with:
76-
python-version: '3.10'
70+
- uses: actions/cache@v4
71+
with:
72+
path: ~/.cache/pip
73+
key: ${{ runner.os }}-pip
7774

78-
- uses: actions/cache@v4
79-
with:
80-
path: ~/.cache/pip
81-
key: ${{ runner.os }}-pip
75+
- name: Validate results
76+
continue-on-error: true
77+
id: validate
78+
run: |
79+
pip install sarif-tools
80+
sarif --version
81+
sarif diff ${{ steps.analyze.outputs.sarif-output }} .github/workflows/javascript.sarif.expected -o sarif-diff.json
82+
cat sarif-diff.json
83+
! grep -q "[1-9]" sarif-diff.json
8284
83-
- name: Validate results
84-
continue-on-error: true
85-
id: validate
86-
run: |
87-
pip install sarif-tools
88-
sarif --version
89-
sarif diff ${{ steps.analyze.outputs.sarif-output }} .github/workflows/javascript.sarif.expected -o sarif-diff.json
90-
cat sarif-diff.json
91-
! grep -q "[1-9]" sarif-diff.json
85+
- name: Upload sarif change
86+
if: steps.validate.outcome != 'success'
87+
uses: actions/upload-artifact@v6
88+
with:
89+
name: sarif
90+
path: |
91+
sarif-diff.json
92+
${{ steps.analyze.outputs.sarif-output }}
9293
93-
- name: Upload sarif change
94-
if: steps.validate.outcome != 'success'
95-
uses: actions/upload-artifact@v6
96-
with:
97-
name: sarif
98-
path: |
99-
sarif-diff.json
100-
${{ steps.analyze.outputs.sarif-output }}
101-
102-
- name: Unexpected Code Scanning results
103-
if: steps.validate.outcome != 'success'
104-
run: |
105-
cat sarif-diff.json
106-
echo "::error::Unexpected Code Scanning results!" && exit 1
94+
- name: Unexpected Code Scanning results
95+
if: steps.validate.outcome != 'success'
96+
run: |
97+
cat sarif-diff.json
98+
echo "::error::Unexpected Code Scanning results!" && exit 1

‎.github/workflows/javascript.sarif.expected‎

Lines changed: 1 addition & 1 deletion
Large diffs are not rendered by default.

‎javascript/frameworks/cap/src/qlpack.yml‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -6,5 +6,5 @@ suites: codeql-suites
66
extractor: javascript
77
dependencies:
88
codeql/javascript-all: "^2.6.22"
9-
advanced-security/javascript-sap-cap-all: "${workspace}"
9+
advanced-security/javascript-sap-cap-all: "2.24.3"
1010
default-suite-file: codeql-suites/javascript-code-scanning.qls

‎javascript/frameworks/cap/test/qlpack.yml‎

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -4,6 +4,6 @@ version: 2.24.3
44
extractor: javascript
55
dependencies:
66
codeql/javascript-all: "^2.6.22"
7-
advanced-security/javascript-sap-cap-queries: "${workspace}"
8-
advanced-security/javascript-sap-cap-models: "${workspace}"
9-
advanced-security/javascript-sap-cap-all: "${workspace}"
7+
advanced-security/javascript-sap-cap-queries: "2.24.3"
8+
advanced-security/javascript-sap-cap-models: "2.24.3"
9+
advanced-security/javascript-sap-cap-all: "2.24.3"

‎javascript/frameworks/ui5-webcomponents/test/qlpack.yml‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -3,4 +3,4 @@ version: 2.24.3
33
extractor: javascript
44
dependencies:
55
codeql/javascript-all: "^2.6.22"
6-
advanced-security/javascript-sap-ui5-all: "${workspace}"
6+
advanced-security/javascript-sap-ui5-all: "2.24.3"

‎javascript/frameworks/ui5-webcomponents/test/queries/xss-input-dangerouslySetInnerHTML/package-lock.json‎

Lines changed: 3 additions & 3 deletions
Some generated files are not rendered by default. Learn more about customizing how changed files appear on GitHub.

‎javascript/frameworks/ui5/lib/advanced_security/javascript/frameworks/ui5/UI5LogsToHttpQuery.qll‎

Lines changed: 9 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -26,12 +26,15 @@ module UI5LogEntryToHttp implements DataFlow::StateConfigSig {
2626
predicate isAdditionalFlowStep(
2727
DataFlow::Node start, FlowState preState, DataFlow::Node end, FlowState postState
2828
) {
29-
UI5LogInjection::isAdditionalFlowStep(start, end) and
30-
preState = postState
31-
or
32-
logArgumentToListener(start, end) and
33-
preState = "not-logged-not-accessed" and
34-
postState = "logged-and-accessed"
29+
inSameWebApp(start.getFile(), end.getFile()) and
30+
(
31+
UI5LogInjection::isAdditionalFlowStep(start, end) and
32+
preState = postState
33+
or
34+
logArgumentToListener(start, end) and
35+
preState = "not-logged-not-accessed" and
36+
postState = "logged-and-accessed"
37+
)
3538
}
3639

3740
predicate isSink(DataFlow::Node node, FlowState state) {

‎javascript/frameworks/ui5/lib/advanced_security/javascript/frameworks/ui5/UI5XssQuery.qll‎

Lines changed: 29 additions & 26 deletions
Original file line numberDiff line numberDiff line change
@@ -49,33 +49,36 @@ module UI5Xss implements DataFlow::ConfigSig {
4949
}
5050

5151
predicate isAdditionalFlowStep(DataFlow::Node start, DataFlow::Node end) {
52-
/* Already an additional flow step defined in `DomBasedXssQuery::Configuration` */
53-
DomBasedXss::DomBasedXssConfig::isAdditionalFlowStep(start, _, end, _)
54-
or
55-
/* TODO: Legacy code */
56-
/* Handler argument node to handler parameter */
57-
exists(UI5Handler h |
58-
start = h.getBindingPath().getNode() and
59-
/*
60-
* Ideally we would like to show an intermediate node where
61-
* the handler is bound to a control, but there is no sourceNode there
62-
* `end = h.getBindingPath() or start = h.getBindingPath()`
63-
*/
52+
inSameWebApp(start.getFile(), end.getFile()) and
53+
(
54+
/* Already an additional flow step defined in `DomBasedXssQuery::Configuration` */
55+
DomBasedXss::DomBasedXssConfig::isAdditionalFlowStep(start, _, end, _)
56+
or
57+
/* TODO: Legacy code */
58+
/* Handler argument node to handler parameter */
59+
exists(UI5Handler h |
60+
start = h.getBindingPath().getNode() and
61+
/*
62+
* Ideally we would like to show an intermediate node where
63+
* the handler is bound to a control, but there is no sourceNode there
64+
* `end = h.getBindingPath() or start = h.getBindingPath()`
65+
*/
6466

65-
end = h.getParameter(0)
66-
)
67-
or
68-
/* Flow from `setContent` to `getContent` of a control */
69-
exists(
70-
UI5Control control, DataFlow::MethodCallNode getContent, DataFlow::MethodCallNode setContent
71-
|
72-
control.asJsControl() = setContent.getReceiver().getALocalSource() and
73-
control.asJsControl() = getContent.getReceiver().getALocalSource() and
74-
setContent.getMethodName() = "setContent" and
75-
getContent.getMethodName() = "getContent" and
76-
start = setContent.getArgument(0) and
77-
end = getContent and
78-
not control.isHTMLSanitized()
67+
end = h.getParameter(0)
68+
)
69+
or
70+
/* Flow from `setContent` to `getContent` of a control */
71+
exists(
72+
UI5Control control, DataFlow::MethodCallNode getContent, DataFlow::MethodCallNode setContent
73+
|
74+
control.asJsControl() = setContent.getReceiver().getALocalSource() and
75+
control.asJsControl() = getContent.getReceiver().getALocalSource() and
76+
setContent.getMethodName() = "setContent" and
77+
getContent.getMethodName() = "getContent" and
78+
start = setContent.getArgument(0) and
79+
end = getContent and
80+
not control.isHTMLSanitized()
81+
)
7982
)
8083
}
8184
}

0 commit comments

Comments
 (0)