Skip to content

Commit 52cd1f2

Browse files
robertbrignullrobertbrignull
authored
Merge branch 'master' into analysisName
2 parents 3455736 + f668f5f commit 52cd1f2

15 files changed

+279
-75
lines changed

‎README.md‎

Lines changed: 9 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -2,6 +2,12 @@
22

33
This action runs GitHub's industry-leading static analysis engine, CodeQL, against a repository's source code to find security vulnerabilities. It then automatically uploads the results to GitHub so they can be displayed in the repository's security tab. CodeQL runs an extensible set of [queries](https://github.com/semmle/ql), which have been developed by the community and the [GitHub Security Lab](https://securitylab.github.com/) to find common vulnerabilities in your code.
44

5+
## License
6+
7+
This project is released under the [MIT License](LICENSE).
8+
9+
The underlying CodeQL CLI, used in this action, is licensed under the [GitHub CodeQL Terms and Conditions](https://securitylab.github.com/tools/codeql/license). As such, this action may be used on open source projects hosted on GitHub, and on private repositories that are owned by an organisation with GitHub Advanced Security enabled.
10+
511
## Usage
612

713
To get code scanning results from CodeQL analysis on your repo you can use the following workflow as a template:
@@ -137,7 +143,7 @@ env:
137143

138144
to `github/codeql-action/analyze`.
139145

140-
### If you do not use a vendor directory
146+
#### If you do not use a vendor directory
141147

142148
Dependencies on public repositories should just work. If you have dependencies on private repositories, one option is to use `git config` and a [personal access token](https://help.github.com/en/github/authenticating-to-github/creating-a-personal-access-token-for-the-command-line) to authenticate when downloading dependencies. Add a section like
143149

@@ -163,6 +169,6 @@ dotnet build /p:UseSharedCompilation=false
163169

164170
Version 3 does not require the additional flag.
165171

166-
## License
172+
### Analysing Go together with other languages on `macos-latest`
167173

168-
This project is released under the [MIT License](LICENSE).
174+
When running on macos it is currently not possible to analyze Go in conjunction with any of Java, C/C++, or C#. Each language can still be analyzed separately.

‎lib/autobuild.js‎

Lines changed: 7 additions & 3 deletions
Some generated files are not rendered by default. Learn more about customizing how changed files appear on GitHub.

‎lib/external-queries.js‎

Lines changed: 2 additions & 1 deletion
Some generated files are not rendered by default. Learn more about customizing how changed files appear on GitHub.

‎lib/finalize-db.js‎

Lines changed: 4 additions & 1 deletion
Some generated files are not rendered by default. Learn more about customizing how changed files appear on GitHub.

‎lib/upload-lib.js‎

Lines changed: 62 additions & 25 deletions
Some generated files are not rendered by default. Learn more about customizing how changed files appear on GitHub.

‎lib/upload-sarif.js‎

Lines changed: 7 additions & 3 deletions
Some generated files are not rendered by default. Learn more about customizing how changed files appear on GitHub.

‎lib/util.js‎

Lines changed: 10 additions & 0 deletions
Some generated files are not rendered by default. Learn more about customizing how changed files appear on GitHub.

‎queries/undeclared-action-input.ql‎

Lines changed: 65 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,65 @@
1+
/**
2+
* @name Undeclared action input
3+
* @description Code tries to use an input parameter that is not defined for this action.
4+
Perhaps this code is shared by multiple actions.
5+
* @kind problem
6+
* @problem.severity error
7+
* @id javascript/codeql-action/undeclared-action-input
8+
*/
9+
10+
import javascript
11+
12+
class ActionDeclaration extends File {
13+
ActionDeclaration() {
14+
getRelativePath().matches("%/action.yml")
15+
}
16+
17+
string getName() {
18+
result = getRelativePath().regexpCapture("(.*)/action.yml", 1)
19+
}
20+
21+
YAMLDocument getRootNode() {
22+
result.getFile() = this
23+
}
24+
25+
string getAnInput() {
26+
result = getRootNode().(YAMLMapping).lookup("inputs").(YAMLMapping).getKey(_).(YAMLString).getValue()
27+
}
28+
29+
FunctionDeclStmt getEntrypoint() {
30+
result.getFile().getRelativePath() = getRootNode().
31+
(YAMLMapping).lookup("runs").
32+
(YAMLMapping).lookup("main").
33+
(YAMLString).getValue().regexpReplaceAll("\\.\\./lib/(.*)\\.js", "src/$1.ts") and
34+
result.getName() = "run"
35+
}
36+
}
37+
38+
Expr getAFunctionChildExpr(Function f) {
39+
result.getContainer() = f
40+
}
41+
42+
/*
43+
* Result is a function that is called from the body of the given function `f`
44+
*/
45+
Function calledBy(Function f) {
46+
result = getAFunctionChildExpr(f).(InvokeExpr).getResolvedCallee()
47+
or
48+
result.getEnclosingContainer() = f // assume outer function causes inner function to be called
49+
}
50+
51+
class GetInputMethodCallExpr extends MethodCallExpr {
52+
GetInputMethodCallExpr() {
53+
getMethodName() = "getInput"
54+
}
55+
56+
string getInputName() {
57+
result = getArgument(0).(StringLiteral).getValue()
58+
}
59+
}
60+
61+
from ActionDeclaration action, GetInputMethodCallExpr getInputCall, string inputName
62+
where getAFunctionChildExpr(calledBy*(action.getEntrypoint())) = getInputCall and
63+
inputName = getInputCall.getInputName() and
64+
not inputName = action.getAnInput()
65+
select getInputCall, "The $@ input is not defined for the $@ action", inputName, inputName, action, action.getName()

‎src/autobuild.ts‎

Lines changed: 8 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -15,7 +15,8 @@ async function run() {
1515
// We want pick the dominant language in the repo from the ones we're able to build
1616
// The languages are sorted in order specified by user or by lines of code if we got
1717
// them from the GitHub API, so try to build the first language on the list.
18-
const language = process.env[sharedEnv.CODEQL_ACTION_TRACED_LANGUAGES]?.split(',')[0];
18+
const autobuildLanguages = process.env[sharedEnv.CODEQL_ACTION_TRACED_LANGUAGES]?.split(',') || [];
19+
const language = autobuildLanguages[0];
1920

2021
if (!language) {
2122
core.info("None of the languages in this project require extra build steps");
@@ -24,6 +25,10 @@ async function run() {
2425

2526
core.debug(`Detected dominant traced language: ${language}`);
2627

28+
if (autobuildLanguages.length > 1) {
29+
core.warning(`We will only automatically build ${language} code. If you wish to scan ${autobuildLanguages.slice(1).join(' and ')}, you must replace this block with custom build steps.`);
30+
}
31+
2732
core.startGroup(`Attempting to automatically build ${language} code`);
2833
// TODO: share config accross actions better via env variables
2934
const codeqlCmd = util.getRequiredEnvParam(sharedEnv.CODEQL_ACTION_CMD);
@@ -44,7 +49,7 @@ async function run() {
4449
core.endGroup();
4550

4651
} catch (error) {
47-
core.setFailed(error.message);
52+
core.setFailed("We were unable to automatically build your code. Please replace the call to the autobuild action with your custom build steps. " + error.message);
4853
await util.reportActionFailed('autobuild', error.message, error.stack);
4954
return;
5055
}
@@ -53,6 +58,6 @@ async function run() {
5358
}
5459

5560
run().catch(e => {
56-
core.setFailed("autobuild action failed: " + e);
61+
core.setFailed("autobuild action failed. " + e);
5762
console.log(e);
5863
});

0 commit comments

Comments
 (0)