Skip to content

Commit 6b5094f

Browse files
GeekMasherGeekMasher
authored
Merge branch 'main' into go-local-sources
2 parents e72dfbe + 68fd949 commit 6b5094f

File tree

23 files changed

+489
-55
lines changed

23 files changed

+489
-55
lines changed

‎.devcontainer/devcontainer.json

Lines changed: 15 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,15 @@
1+
{
2+
"name": "CodeQL-Community-Packs",
3+
"extensions": [
4+
"github.vscode-codeql",
5+
"github.copilot"
6+
],
7+
"settings": {
8+
"codeQL.runningQueries.autoSave": true,
9+
"codeQL.runningQueries.numberOfThreads": 4,
10+
"codeQL.runningQueries.debug": true,
11+
"editor.formatOnSave": true
12+
},
13+
"postCreateCommand": "git submodule init && git submodule update --recursive",
14+
"remoteUser": "root"
15+
}

‎.github/CODEOWNERS

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,3 @@
1+
# This project is maintained with love by:
2+
3+
- @pwntester @geekmasher

‎.github/scripts/pr-configs.sh

Lines changed: 31 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,31 @@
1+
#!/bin/bash
2+
set -euo pipefail
3+
4+
PR_NUMBER=${1}
5+
6+
codeql_code="/tmp/codeql-test-code"
7+
codeql_db="/tmp/codeql-test-database"
8+
9+
for file in $(gh pr view $PR_NUMBER --json files --jq '.files.[].path'); do
10+
if [[ ! -f "$file" ]]; then
11+
continue
12+
fi
13+
14+
# config file
15+
if [[ "$file" == configs/*.yml ]]; then
16+
echo "[+] Compiling Config :: $file"
17+
18+
if [[ -d "$codeql_db" ]]; then
19+
rm -rf "$codeql_db"
20+
fi
21+
22+
mkdir -p "$codeql_code"
23+
echo "print('Hello, World!')" > "$codeql_code/main.py"
24+
25+
codeql database create \
26+
--source-root=$codeql_code \
27+
--language=python \
28+
--codescanning-config=$file \
29+
"$codeql_db"
30+
fi
31+
done

‎.github/workflows/build.yml

Lines changed: 31 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -141,3 +141,34 @@ jobs:
141141
codeql pack install "${{ matrix.language }}/ext-library-sources/"
142142
codeql pack create "${{ matrix.language }}/ext-library-sources/"
143143
144+
configs:
145+
runs-on: ubuntu-latest
146+
needs: compile
147+
148+
steps:
149+
- uses: actions/checkout@v3
150+
151+
- uses: dorny/paths-filter@4512585405083f25c027a35db413c2b3b9006d50
152+
id: changes
153+
with:
154+
filters: |
155+
src:
156+
- 'configs/**'
157+
158+
- name: Initialize CodeQL
159+
if: steps.changes.outputs.src == 'true'
160+
run: |
161+
VERSION="$(find "${{ runner.tool_cache }}/CodeQL/" -maxdepth 1 -mindepth 1 -type d -print \
162+
| sort \
163+
| tail -n 1 \
164+
| tr -d '\n')"
165+
echo "$VERSION/x64/codeql" >> $GITHUB_PATH
166+
167+
- name: "Check Configurations"
168+
if: steps.changes.outputs.src == 'true'
169+
env:
170+
GITHUB_TOKEN: ${{ github.token }}
171+
run: |
172+
./.github/scripts/pr-configs.sh "${{ github.event.number }}"
173+
174+

‎README.md

Lines changed: 16 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -33,6 +33,18 @@ Using a `githubsecuritylab/codeql-LANG-queries` query pack will reference the de
3333
packs: githubsecuritylab/codeql-${{ matrix.language }}-queries
3434
```
3535
36+
### Using community packs with provided configuration file
37+
38+
This repository has a number of [provided configuration files][configurations] you can use or copy from the community packs.
39+
40+
```yaml
41+
- name: Initialize CodeQL
42+
uses: github/codeql-action/init@v2
43+
with:
44+
languages: ${{ matrix.language }}
45+
config-file: GitHubSecurityLab/CodeQL-Community-Packs/configs/default.yml@main
46+
```
47+
3648
### Using a community pack from the CLI configuration file
3749
3850
```bash
@@ -54,3 +66,7 @@ This project is licensed under the terms of the MIT open source license. Please
5466
## Support
5567

5668
Please [create GitHub issues](https://github.com/advanced-security/brew-dependency-submission-action) for any feature requests, bugs, or documentation problems.
69+
70+
<!-- Resources / Links -->
71+
72+
[configurations]: ./configs

‎configs/README.md

Lines changed: 26 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,26 @@
1+
# Community Configurations
2+
3+
## [Default / CodeQL](default.yml)
4+
5+
The `default.yml` configuration is the default config file used to make it easy to use the CodeQL Community Packs. The queries included here are pulled in from the language `default suites` automatically when referencing the community packs. The default suites as specified in each language's `{LANG}/src/qlpack.yml`. The standard configuration is:
6+
```yml
7+
defaultSuiteFile: suites/{LANG}.qls
8+
```
9+
10+
## [Audit](audit.yml)
11+
12+
The `audit.yml` configuration is used primarily to conduct a security assessment of potentially vulnerable code, by running a number of audit queries with CodeQL. Many of these queries operate on partial path queries, thus not seeking complete source/sink flows. Use these wide-ranging queries or [partial flow paths](https://codeql.github.com/docs/writing-codeql-queries/debugging-data-flow-queries-using-partial-flow/) as tools to infer potential taint disruptions and identify opportunities for customization improvements.
13+
14+
These are based on the suite in each language suites folder called `{LANG}-audit.qls`
15+
16+
> [!NOTE]
17+
> Current Ruby and Swift are not supported
18+
19+
## [Synthetics](synthetics.yml)
20+
21+
This `synthetics.yml` configuration is intended for analyzing synthetic ([intentionally vulnerable](https://owasp.org/www-project-vulnerable-web-applications-directory/)) code samples for vulnerabilities. This configuration uses all possible security queries/extensions from the CodeQL built in packs, the CodeQL Community Packs, and additional OSS packs. It also includes the queries from the built-in `security-experimental.qls` suite with additional lower precision/experimental queries:
22+
- queries marked as `@precision: low` or missing a precision
23+
- queries marked as `@problem.severity: recommendation`
24+
- queries in `\experimental\` folders
25+
26+
This configuration will provide a more thorough analysis at the cost of longer analysis times and potential false positives. Consider using the `audit.yml` configuration to look for additional false negative scenarios.

‎configs/audit.yml

Lines changed: 22 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,22 @@
1+
name: "GitHub Community Pack Audit Configuration"
2+
3+
packs:
4+
# C/C++
5+
- githubsecuritylab/codeql-cpp-queries:suites/cpp-audit.qls
6+
# C#
7+
- githubsecuritylab/codeql-csharp-queries:suites/csharp-audit.qls
8+
- githubsecuritylab/codeql-csharp-extensions
9+
- githubsecuritylab/codeql-csharp-library-sources
10+
# Go
11+
- githubsecuritylab/codeql-go-queries:suites/go-audit.qls
12+
# Java
13+
- githubsecuritylab/codeql-java-queries:suites/java-audit.qls
14+
- githubsecuritylab/codeql-java-extensions
15+
- githubsecuritylab/codeql-java-library-sources
16+
# JavaScript / Typescript
17+
- githubsecuritylab/codeql-javascript-queries:suites/javascript-audit.qls
18+
# Python
19+
- githubsecuritylab/codeql-python-queries:suites/python-audit.qls
20+
# Ruby
21+
# - githubsecuritylab/codeql-ruby-queries:suites/ruby-audit.qls
22+

‎configs/default.yml

Lines changed: 22 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,22 @@
1+
name: "GitHub Community Pack Default CodeQL Configuration"
2+
3+
packs:
4+
# C/C++
5+
- githubsecuritylab/codeql-cpp-queries
6+
# C#
7+
- githubsecuritylab/codeql-csharp-queries
8+
- githubsecuritylab/codeql-csharp-extensions
9+
- githubsecuritylab/codeql-csharp-library-sources
10+
# Go
11+
- githubsecuritylab/codeql-go-queries
12+
# Java
13+
- githubsecuritylab/codeql-java-queries
14+
- githubsecuritylab/codeql-java-extensions
15+
- githubsecuritylab/codeql-java-library-sources
16+
# JavaScript / Typescript
17+
- githubsecuritylab/codeql-javascript-queries
18+
# Python
19+
- githubsecuritylab/codeql-python-queries
20+
# Ruby
21+
- githubsecuritylab/codeql-ruby-queries
22+

‎configs/synthetics.yml

Lines changed: 116 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,116 @@
1+
# Use this configuration file when looking to get the broadest coverage of security results from the CodeQL Built in packs and the GitHub Security Lab Community packs.
2+
# WARNING: A notable amount of false positives may be found in this configuration. If you wish to reduce the number of false positives, use the default codeql suites :)
3+
# NOTE: This configuration will not include audit level queries intended for gathering information about the codebase, and debugging queries intended for CodeQL developers.
4+
5+
name: "Synthetic Apps All Queries Config"
6+
7+
# expand thread model - https://docs.github.com/en/code-security/code-scanning/creating-an-advanced-setup-for-code-scanning/customizing-your-advanced-setup-for-code-scanning#extending-codeql-coverage-with-threat-models
8+
threat-models: local
9+
10+
# start from scratch - https://docs.github.com/en/code-security/code-scanning/creating-an-advanced-setup-for-code-scanning/customizing-your-advanced-setup-for-code-scanning#disabling-the-default-queries
11+
disable-default-queries: true
12+
13+
packs:
14+
# All queries from the CodeQL Built in packs (including low/no precision queries)
15+
- codeql/cpp-queries:.
16+
- codeql/csharp-queries:.
17+
- codeql/go-queries:.
18+
- codeql/java-queries:.
19+
- codeql/javascript-queries:.
20+
- codeql/python-queries:.
21+
- codeql/ruby-queries:.
22+
- codeql/swift-queries:.
23+
24+
# OSS queries from the default suites
25+
26+
### GitHub Security Lab###
27+
# Queries via Community Packs https://github.com/GitHubSecurityLab/CodeQL-Community-Packs (NOTE: the default suites do not include audit/debugging queries)
28+
- githubsecuritylab/codeql-cpp-queries
29+
- githubsecuritylab/codeql-csharp-queries
30+
- githubsecuritylab/codeql-go-queries
31+
- githubsecuritylab/codeql-java-queries
32+
- githubsecuritylab/codeql-javascript-queries
33+
- githubsecuritylab/codeql-python-queries
34+
- githubsecuritylab/codeql-ruby-queries
35+
36+
# Queries via Community Packs that use local sources https://github.com/GitHubSecurityLab/CodeQL-Community-Packs
37+
- githubsecuritylab/codeql-java-queries:suites/java-local.qls
38+
- githubsecuritylab/codeql-python-queries:suites/python-local.qls
39+
40+
# Data extensions via Community Packs for libraries (library ext models are those generated by the corresponding queries in src) https://github.com/GitHubSecurityLab/CodeQL-Community-Packs
41+
- githubsecuritylab/codeql-csharp-library-sources
42+
- githubsecuritylab/codeql-java-library-sources
43+
44+
# Data extensions via Community Packs https://github.com/GitHubSecurityLab/CodeQL-Community-Packs
45+
- githubsecuritylab/codeql-csharp-extensions
46+
- githubsecuritylab/codeql-java-extensions
47+
48+
### Trail of Bits ###
49+
# Queris via packs: https://github.com/trailofbits/codeql-queries (default suites include security + crypto
50+
- trailofbits/cpp-queries
51+
- trailofbits/go-queries
52+
53+
# Start with Security Experimental (lightly documented: https://github.com/github/codeql/pull/11702) : https://github.com/github/codeql/blob/main/misc/suite-helpers/security-experimental-selectors.yml
54+
# - precision ( low + Low or EXCLUDED precision)
55+
# + problem.severity: recommendation
56+
# - restriction of no experimental folder
57+
# - restriction of audit/debugging queries from community packs
58+
query-filters:
59+
- include:
60+
kind:
61+
- problem
62+
- path-problem
63+
tags contain:
64+
- security
65+
- include:
66+
kind:
67+
- diagnostic
68+
- include:
69+
kind:
70+
- metric
71+
tags contain:
72+
- summary
73+
- exclude:
74+
deprecated: //
75+
- exclude:
76+
query path:
77+
# REMOVE exclude - OK even if they exist in experimental folder
78+
#- /^experimental\/.*/
79+
- Metrics/Summaries/FrameworkCoverage.ql
80+
- /Diagnostics/Internal/.*/
81+
- exclude:
82+
tags contain:
83+
- modeleditor
84+
- modelgenerator
85+
# Exclude audit queries from the CodeQL Built in packs
86+
- exclude:
87+
id:
88+
- cpp/untrusted-data-to-external-api
89+
- cs/untrusted-data-to-external-api
90+
- go/untrusted-data-to-external-api
91+
- java/untrusted-data-to-external-api
92+
- js/untrusted-data-to-external-api
93+
- py/untrusted-data-to-external-api
94+
95+
# Remove debugging, and audit queries used by community packs (this is duplicative of the default suites from those community packs)
96+
- exclude:
97+
tags contain:
98+
- debugging
99+
- audit
100+
101+
#Additional extractor excludes: https://github.com/github/codeql/blob/768e5190a1c9d40a4acc7143c461c3b114e7fd59/javascript/extractor/src/com/semmle/js/extractor/AutoBuild.java#L421-L427C42
102+
paths-ignore:
103+
# Python
104+
- "vendor/**"
105+
- "examples/**"
106+
- "tests/**"
107+
108+
# JavaScript
109+
- "node_modules"
110+
- "**/*.test.js"
111+
- "**/*.test.tsx"
112+
- "**/*.spec.ts"
113+
- "**/*.spec.tsx"
114+
- "dist"
115+
- "CoverageResults"
116+
- "**/wwwroot/lib/**"

‎csharp/ext/manual/java-dotenv.model.yml

Lines changed: 22 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,22 @@
1+
extensions:
2+
- addsTo:
3+
pack: codeql/java-all
4+
extensible: sourceModel
5+
data:
6+
- ["io.github.cdimascio.dotenv","Dotenv",true,"get","(String)","","ReturnValue","local","manual"]
7+
8+
- addsTo:
9+
pack: codeql/java-all
10+
extensible: sinkModel
11+
data: []
12+
13+
- addsTo:
14+
pack: codeql/java-all
15+
extensible: summaryModel
16+
data: []
17+
18+
- addsTo:
19+
pack: codeql/java-all
20+
extensible: neutralModel
21+
data:
22+
- ["io.github.cdimascio.dotenv","Dotenv","load","()","summary","manual"]

‎go/lib/codeql-pack.lock.yml

Lines changed: 8 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -2,15 +2,17 @@
22
lockVersion: 1.0.0
33
dependencies:
44
codeql/dataflow:
5-
version: 0.0.3
5+
version: 0.2.7
66
codeql/go-all:
7-
version: 0.6.4
7+
version: 0.8.1
88
codeql/mad:
9-
version: 0.1.4
9+
version: 0.2.16
1010
codeql/ssa:
11-
version: 0.1.4
11+
version: 0.2.16
1212
codeql/tutorial:
13-
version: 0.1.4
13+
version: 0.2.16
14+
codeql/typetracking:
15+
version: 0.2.16
1416
codeql/util:
15-
version: 0.1.4
17+
version: 0.2.16
1618
compiled: false

‎go/src/audit/CWE-089/SqlInjectionAudit.ql

Lines changed: 17 additions & 11 deletions
Original file line numberDiff line numberDiff line change
@@ -12,24 +12,30 @@
1212
*/
1313

1414
import go
15-
import semmle.go.security.SqlInjection
16-
import DataFlow::PathGraph
1715
import ghsl.Utils
16+
private import semmle.go.security.SqlInjectionCustomizations
1817

1918
/**
2019
* A taint-tracking configuration for detecting SQL injection vulnerabilities.
2120
*/
22-
class SqlInjectionAudit extends TaintTracking::Configuration {
23-
SqlInjectionAudit() { this = "SqlInjectionAudit" }
21+
private module Config implements DataFlow::ConfigSig {
22+
predicate isSource(DataFlow::Node source) { source instanceof DynamicStrings }
2423

25-
override predicate isSource(DataFlow::Node source) { source instanceof DynamicStrings }
24+
predicate isSink(DataFlow::Node sink) { sink instanceof SqlInjection::Sink }
2625

27-
override predicate isSink(DataFlow::Node sink) { sink instanceof SqlInjection::Sink }
26+
predicate isAdditionalFlowStep(DataFlow::Node pred, DataFlow::Node succ) {
27+
NoSql::isAdditionalMongoTaintStep(pred, succ)
28+
}
2829

29-
override predicate isSanitizer(DataFlow::Node node) { node instanceof SqlInjection::Sanitizer }
30+
predicate isBarrier(DataFlow::Node node) { node instanceof SqlInjection::Sanitizer }
3031
}
3132

32-
from SqlInjectionAudit config, DataFlow::PathNode source, DataFlow::PathNode sink
33-
where config.hasFlowPath(source, sink)
34-
select sink.getNode(), source, sink, "This SQL query depends on $@.", source.getNode(),
35-
"a user-provided value"
33+
/** Tracks taint flow for reasoning about SQL-injection vulnerabilities. */
34+
module Flow = TaintTracking::Global<Config>;
35+
36+
import Flow::PathGraph
37+
38+
from Flow::PathNode source, Flow::PathNode sink
39+
where Flow::flowPath(source, sink)
40+
select sink.getNode(), source, sink, "This query depends on a $@.", source.getNode(),
41+
"user-provided value"

0 commit comments

Comments
 (0)