Skip to content

Fixes pack rename in audit suites + adds CPP audit suite #35

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
merged 2 commits into from
Jan 9, 2024
Merged

Fixes pack rename in audit suites + adds CPP audit suite #35

merged 2 commits into from
Jan 9, 2024

Conversation

felickz
Copy link
Contributor

@felickz felickz commented Jan 6, 2024

Changes
Resolve some inconsistencies using the old community pack names in the audit suites

packs:         
    # DNE 
    - githubsecuritylab/codeql-cpp-queries:suites/cpp-audit.qls
    # FAILS
    - githubsecuritylab/codeql-csharp-queries:suites/csharp-audit.qls
  • error: A fatal error occurred: The QL pack 'githubsecuritylab/codeql-csharp' which is referenced from C:\.....\.codeql\packages\githubsecuritylab\codeql-csharp-queries\0.0.3\suites\csharp-audit.qls cannot be found.
  • Adds audit suite for CPP

Here are the most important changes:

Changes to Audit Query Sources:

@GeekMasher
Copy link
Contributor

Looks good from my side!

@GeekMasher GeekMasher merged commit a4c4fca into GitHubSecurityLab:main Jan 9, 2024
@felickz
Copy link
Contributor Author

felickz commented Jan 9, 2024

Working now for csharp

[1/6] Loaded C:\Users\chadbentz\.codeql\packages\githubsecuritylab\codeql-csharp-queries\0.0.4\audit\CWE-078\CommandInjectionAudit.qlx.
[2/6] Loaded C:\Users\chadbentz\.codeql\packages\githubsecuritylab\codeql-csharp-queries\0.0.4\audit\CWE-094\CodeInjectionAudit.qlx.
[3/6] Loaded C:\Users\chadbentz\.codeql\packages\githubsecuritylab\codeql-csharp-queries\0.0.4\audit\CWE-502\UnsafeDeserializationAudit.qlx.
[4/6] Loaded C:\Users\chadbentz\.codeql\packages\githubsecuritylab\codeql-csharp-queries\0.0.4\audit\CWE-611\UnsafeXMLResolverAudit.qlx.
[5/6] Loaded C:\Users\chadbentz\.codeql\packages\githubsecuritylab\codeql-csharp-queries\0.0.4\security\CWE-328\WeakHashingAlgorithms.qlx.
[6/6] Loaded C:\Utils\codeql\qlpacks\codeql\csharp-queries\0.8.0\Security Features\CWE-020\UntrustedDataToExternalAPI.qlx.

felickz added a commit to felickz/custom-codeql that referenced this pull request Jan 18, 2024
- add queries that explicitly target local sources from OSS pack (pulls in built in queries)
- publish a config that explicitly targets local sources where possible (without pulling in lower precision queries)
- audit pack is working better now due to fix GitHubSecurityLab/CodeQL-Community-Packs#35
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

2 participants