Skip to content

Commit 2bf3faa

Browse files
henrymercerhenrymercer
committed
Correct query metadata for actions/untrusted-checkout/medium 
1 parent 93a4b42 commit 2bf3faa

4 files changed

Lines changed: 22 additions & 18 deletions

File tree

‎actions/ql/lib/codeql/actions/Helper.qll‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -30,7 +30,7 @@ predicate inPrivilegedContext(AstNode node, Event event) {
3030
node.getEnclosingJob().isPrivilegedExternallyTriggerable(event)
3131
}
3232

33-
predicate inNonPrivilegedContext(AstNode node) {
33+
predicate inUnprivilegedContext(AstNode node) {
3434
not node.getEnclosingJob().isPrivilegedExternallyTriggerable(_)
3535
}
3636

‎actions/ql/src/Security/CWE-829/UntrustedCheckoutMedium.ql‎

Lines changed: 7 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -1,8 +1,8 @@
11
/**
2-
* @name Checkout of untrusted code in a trusted context
3-
* @description Privileged workflows have read/write access to the base repository and access to secrets.
4-
* By explicitly checking out and running the build script from a fork the untrusted code is running in an environment
5-
* that is able to push to the base repository and to access secrets.
2+
* @name Checkout of untrusted code in unprivileged context
3+
* @description Checking out and running the build script from a fork executes untrusted code. Even in an
4+
* unprivileged workflow this can be abused, for example to compromise self-hosted runners
5+
* or to poison caches and artifacts that are later consumed by privileged workflows.
66
* @kind problem
77
* @problem.severity warning
88
* @precision medium
@@ -18,6 +18,6 @@ import codeql.actions.security.UntrustedCheckoutQuery
1818

1919
from PRHeadCheckoutStep checkout
2020
where
21-
// the checkout occurs in a non-privileged context
22-
inNonPrivilegedContext(checkout)
23-
select checkout, "Potential unsafe checkout of untrusted pull request on privileged workflow."
21+
// the checkout occurs in an unprivileged context
22+
inUnprivilegedContext(checkout)
23+
select checkout, "Potential unsafe checkout of untrusted pull request on unprivileged workflow."

‎actions/ql/src/change-notes/2026-06-04-untrusted-checkout-medium-metadata.md‎

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,4 @@
1+
---
2+
category: queryMetadata
3+
---
4+
* The name, description, and alert message of `actions/untrusted-checkout/medium` have been corrected to describe an unprivileged context.

‎actions/ql/test/query-tests/Security/CWE-829/UntrustedCheckoutMedium.expected‎

Lines changed: 10 additions & 10 deletions
Original file line numberDiff line numberDiff line change
@@ -1,10 +1,10 @@
1-
| .github/workflows/artifactpoisoning81.yml:11:9:14:6 | Uses Step | Potential unsafe checkout of untrusted pull request on privileged workflow. |
2-
| .github/workflows/dependabot2.yml:33:9:38:6 | Uses Step | Potential unsafe checkout of untrusted pull request on privileged workflow. |
3-
| .github/workflows/mend.yml:22:9:29:6 | Uses Step | Potential unsafe checkout of untrusted pull request on privileged workflow. |
4-
| .github/workflows/poc3.yml:18:7:25:4 | Uses Step | Potential unsafe checkout of untrusted pull request on privileged workflow. |
5-
| .github/workflows/poc.yml:30:9:36:6 | Uses Step | Potential unsafe checkout of untrusted pull request on privileged workflow. |
6-
| .github/workflows/priv_pull_request_checkout.yml:14:9:20:6 | Uses Step | Potential unsafe checkout of untrusted pull request on privileged workflow. |
7-
| .github/workflows/test3.yml:28:9:33:6 | Uses Step | Potential unsafe checkout of untrusted pull request on privileged workflow. |
8-
| .github/workflows/test4.yml:18:7:25:4 | Uses Step | Potential unsafe checkout of untrusted pull request on privileged workflow. |
9-
| .github/workflows/test8.yml:20:9:26:6 | Uses Step | Potential unsafe checkout of untrusted pull request on privileged workflow. |
10-
| .github/workflows/test9.yml:11:9:16:6 | Uses Step | Potential unsafe checkout of untrusted pull request on privileged workflow. |
1+
| .github/workflows/artifactpoisoning81.yml:11:9:14:6 | Uses Step | Potential unsafe checkout of untrusted pull request on unprivileged workflow. |
2+
| .github/workflows/dependabot2.yml:33:9:38:6 | Uses Step | Potential unsafe checkout of untrusted pull request on unprivileged workflow. |
3+
| .github/workflows/mend.yml:22:9:29:6 | Uses Step | Potential unsafe checkout of untrusted pull request on unprivileged workflow. |
4+
| .github/workflows/poc3.yml:18:7:25:4 | Uses Step | Potential unsafe checkout of untrusted pull request on unprivileged workflow. |
5+
| .github/workflows/poc.yml:30:9:36:6 | Uses Step | Potential unsafe checkout of untrusted pull request on unprivileged workflow. |
6+
| .github/workflows/priv_pull_request_checkout.yml:14:9:20:6 | Uses Step | Potential unsafe checkout of untrusted pull request on unprivileged workflow. |
7+
| .github/workflows/test3.yml:28:9:33:6 | Uses Step | Potential unsafe checkout of untrusted pull request on unprivileged workflow. |
8+
| .github/workflows/test4.yml:18:7:25:4 | Uses Step | Potential unsafe checkout of untrusted pull request on unprivileged workflow. |
9+
| .github/workflows/test8.yml:20:9:26:6 | Uses Step | Potential unsafe checkout of untrusted pull request on unprivileged workflow. |
10+
| .github/workflows/test9.yml:11:9:16:6 | Uses Step | Potential unsafe checkout of untrusted pull request on unprivileged workflow. |

0 commit comments

Comments
 (0)