FazBrowse GitHub Viewer | Trending |
URL:
| Home
Tools: [Download Repo ZIP]   [Original HTTPS Page]

Update unguarded-action-lib.ql to catch uses of actions-util.ts by robertbrignull · Pull Request #542 · github/codeql-action · GitHub

/ codeql-action Public

Update unguarded-action-lib.ql to catch uses of actions-util.ts - #542

Merged
adityasharad merged 1 commit into
mainfrom
robertbrignull/import-actions-lib
Jun 2, 2021
ConversationCommits (1)ChecksFiles changed
Merged

Update unguarded-action-lib.ql to catch uses of actions-util.ts#542
adityasharad merged 1 commit into
mainfrom
robertbrignull/import-actions-lib

Conversation

robertbrignull commented Jun 2, 2021

Copy link
Copy Markdown
Contributor

I'm not 100% sure this change is correct but the PR checks should tell us as this should introduce at least one alert because it'll now spot accesses of actions-util.ts. Because it's using matches but then with a string with no wildcards in it I'm assuming this must be a mistake.

Alternatively we could probably just use getImportedPath().getValue() = "./actions-util") since we currently have all our source in one directory. Is that better? Using matches lets us catch this potential future edge case.

Merge / deployment checklist

  • Confirm this change is backwards compatible with existing workflows.
  • Confirm the readme has been updated if necessary.
  • Confirm the changelog has been updated if necessary.

robertbrignull mentioned this pull request Jun 2, 2021
Merged
3 tasks
adityasharad approved these changes Jun 2, 2021
View reviewed changes

adityasharad left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Choose a reason Spam Abuse Off Topic Outdated Duplicate Resolved Low Quality

Sensible. I was similarly worried that we would break the existing pattern by moving files around.

adityasharad merged commit 1ec2fd7 into main Jun 2, 2021
adityasharad deleted the robertbrignull/import-actions-lib branch June 2, 2021 16:56

aeisenberg commented Jun 2, 2021

Copy link
Copy Markdown
Contributor

Thanks for the fix. It's not showing any new alerts. Is that expected?

robertbrignull commented Jun 3, 2021

Copy link
Copy Markdown
Contributor Author

It's not showing any new alerts. Is that expected?

I was hoping this would generate a new alert. I think that it should be catching the import of setMode in runner.ts should be triggering an alert. I made this PR just off a hunch but probably someone will need to try the query out locally to work it why it's not catching that. Unless of course I'm mistaken and you think that shouldn't be an alert.

aeisenberg commented Jun 3, 2021

Copy link
Copy Markdown
Contributor

Actually, I think the reason is that you based this change on main, but the offending code was still in a PR. When I rebased #539 on main, I started seeing the warning.

robertbrignull commented Jun 7, 2021

Copy link
Copy Markdown
Contributor Author

Ah thanks for working that out. That makes perfect sense.

github-actions Bot mentioned this pull request Jun 7, 2021
Merged
5 tasks
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters. Learn more about bidirectional Unicode characters
Show hidden characters
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

adityasharad adityasharad approved these changes

Assignees

No one assigned

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

3 participants

Back | FazBrowse Home | New Git URL