From 2bef3c3604a3dab1b98d0d44deb578df9a1c6b24 Mon Sep 17 00:00:00 2001 From: Chad Bentz <1760475+felickz@users.noreply.github.com> Date: Wed, 30 Apr 2025 09:44:27 -0400 Subject: [PATCH 1/2] Adding comprehensive docs for customizing query --- .../CWE-829/UnpinnedActionsTag-CUSTOMIZING.md | 39 +++++++++++++++++++ .../Security/CWE-829/UnpinnedActionsTag.md | 2 + 2 files changed, 41 insertions(+) create mode 100644 actions/ql/src/Security/CWE-829/UnpinnedActionsTag-CUSTOMIZING.md diff --git a/actions/ql/src/Security/CWE-829/UnpinnedActionsTag-CUSTOMIZING.md b/actions/ql/src/Security/CWE-829/UnpinnedActionsTag-CUSTOMIZING.md new file mode 100644 index 000000000000..1e64c2751a6f --- /dev/null +++ b/actions/ql/src/Security/CWE-829/UnpinnedActionsTag-CUSTOMIZING.md @@ -0,0 +1,39 @@ + ### Configuration + + If there is an Action publisher that you trust, you can include the owner name/organization in a data extension model pack to add it to the allow list for this query. Adding owners to this list will prevent security alerts when using unpinned tags for Actions published by that owner. + + #### Example + + To allow any Action from the publisher `octodemo`, such as `octodemo/3rd-party-action`, follow these steps: + + 1. Create a data extension file `/models/trusted-owner.model.yml` with the following content: + + ```yaml + extensions: + - addsTo: + pack: codeql/actions-all + extensible: trustedActionsOwnerDataModel + data: + - ["octodemo"] + ``` + + 2. Create a model pack file `/codeql-pack.yml` with the following content: + + ```yaml + name: my-org/actions-extensions-model-pack + version: 0.0.0 + library: true + extensionTargets: + codeql/actions-all: '*' + dataExtensions: + - models/**/*.yml + ``` + + 3. Ensure that the model pack is included in your CodeQL analysis. + + By following these steps, you will add `octodemo` to the list of trusted Action publishers, and the query will no longer generate security alerts for unpinned tags from this publisher. + + ## References + - [Extending CodeQL coverage with CodeQL model packs in default setup](https://docs.github.com/en/code-security/code-scanning/managing-your-code-scanning-configuration/editing-your-configuration-of-default-setup#extending-codeql-coverage-with-codeql-model-packs-in-default-setup) + - [Creating and working with CodeQL packs](https://docs.github.com/en/code-security/codeql-cli/using-the-advanced-functionality-of-the-codeql-cli/creating-and-working-with-codeql-packs#creating-a-codeql-model-pack) + - [Customizing library models for GitHub Actions](https://codeql.github.com/docs/codeql-language-guides/customizing-library-models-for-actions/) diff --git a/actions/ql/src/Security/CWE-829/UnpinnedActionsTag.md b/actions/ql/src/Security/CWE-829/UnpinnedActionsTag.md index f8ea2fdc82fe..7b0749349a7f 100644 --- a/actions/ql/src/Security/CWE-829/UnpinnedActionsTag.md +++ b/actions/ql/src/Security/CWE-829/UnpinnedActionsTag.md @@ -8,6 +8,8 @@ Using a tag for a 3rd party Action that is not pinned to a commit can lead to ex Pinning an action to a full length commit SHA is currently the only way to use a non-immutable action as an immutable release. Pinning to a particular SHA helps mitigate the risk of a bad actor adding a backdoor to the action's repository, as they would need to generate a SHA-1 collision for a valid Git object payload. When selecting a SHA, you should verify it is from the action's repository and not a repository fork. +See the [`UnpinnedActionsTag-CUSTOMIZING.md`](https://github.com/github/codeql/blob/main/actions/ql/src/Security/CWE-829/UnpinnedActionsTag-CUSTOMIZING.md) file in the source code for this query for information on how to extend the list of Action publishers trusted by this query. + ## Examples ### Incorrect Usage From d3aa2a130c4be6716325f3ccaa58cd5c477ffb37 Mon Sep 17 00:00:00 2001 From: Chad Bentz <1760475+felickz@users.noreply.github.com> Date: Thu, 1 May 2025 19:37:26 +0000 Subject: [PATCH 2/2] Moved guidance to RST --- .../CWE-829/UnpinnedActionsTag-CUSTOMIZING.md | 39 ------------------ .../Security/CWE-829/UnpinnedActionsTag.md | 2 - ...customizing-library-models-for-actions.rst | 41 ++++++++++++++++++- 3 files changed, 40 insertions(+), 42 deletions(-) delete mode 100644 actions/ql/src/Security/CWE-829/UnpinnedActionsTag-CUSTOMIZING.md diff --git a/actions/ql/src/Security/CWE-829/UnpinnedActionsTag-CUSTOMIZING.md b/actions/ql/src/Security/CWE-829/UnpinnedActionsTag-CUSTOMIZING.md deleted file mode 100644 index 1e64c2751a6f..000000000000 --- a/actions/ql/src/Security/CWE-829/UnpinnedActionsTag-CUSTOMIZING.md +++ /dev/null @@ -1,39 +0,0 @@ - ### Configuration - - If there is an Action publisher that you trust, you can include the owner name/organization in a data extension model pack to add it to the allow list for this query. Adding owners to this list will prevent security alerts when using unpinned tags for Actions published by that owner. - - #### Example - - To allow any Action from the publisher `octodemo`, such as `octodemo/3rd-party-action`, follow these steps: - - 1. Create a data extension file `/models/trusted-owner.model.yml` with the following content: - - ```yaml - extensions: - - addsTo: - pack: codeql/actions-all - extensible: trustedActionsOwnerDataModel - data: - - ["octodemo"] - ``` - - 2. Create a model pack file `/codeql-pack.yml` with the following content: - - ```yaml - name: my-org/actions-extensions-model-pack - version: 0.0.0 - library: true - extensionTargets: - codeql/actions-all: '*' - dataExtensions: - - models/**/*.yml - ``` - - 3. Ensure that the model pack is included in your CodeQL analysis. - - By following these steps, you will add `octodemo` to the list of trusted Action publishers, and the query will no longer generate security alerts for unpinned tags from this publisher. - - ## References - - [Extending CodeQL coverage with CodeQL model packs in default setup](https://docs.github.com/en/code-security/code-scanning/managing-your-code-scanning-configuration/editing-your-configuration-of-default-setup#extending-codeql-coverage-with-codeql-model-packs-in-default-setup) - - [Creating and working with CodeQL packs](https://docs.github.com/en/code-security/codeql-cli/using-the-advanced-functionality-of-the-codeql-cli/creating-and-working-with-codeql-packs#creating-a-codeql-model-pack) - - [Customizing library models for GitHub Actions](https://codeql.github.com/docs/codeql-language-guides/customizing-library-models-for-actions/) diff --git a/actions/ql/src/Security/CWE-829/UnpinnedActionsTag.md b/actions/ql/src/Security/CWE-829/UnpinnedActionsTag.md index 7b0749349a7f..f8ea2fdc82fe 100644 --- a/actions/ql/src/Security/CWE-829/UnpinnedActionsTag.md +++ b/actions/ql/src/Security/CWE-829/UnpinnedActionsTag.md @@ -8,8 +8,6 @@ Using a tag for a 3rd party Action that is not pinned to a commit can lead to ex Pinning an action to a full length commit SHA is currently the only way to use a non-immutable action as an immutable release. Pinning to a particular SHA helps mitigate the risk of a bad actor adding a backdoor to the action's repository, as they would need to generate a SHA-1 collision for a valid Git object payload. When selecting a SHA, you should verify it is from the action's repository and not a repository fork. -See the [`UnpinnedActionsTag-CUSTOMIZING.md`](https://github.com/github/codeql/blob/main/actions/ql/src/Security/CWE-829/UnpinnedActionsTag-CUSTOMIZING.md) file in the source code for this query for information on how to extend the list of Action publishers trusted by this query. - ## Examples ### Incorrect Usage diff --git a/docs/codeql/codeql-language-guides/customizing-library-models-for-actions.rst b/docs/codeql/codeql-language-guides/customizing-library-models-for-actions.rst index 5676a77cf866..2bf452b5a90b 100644 --- a/docs/codeql/codeql-language-guides/customizing-library-models-for-actions.rst +++ b/docs/codeql/codeql-language-guides/customizing-library-models-for-actions.rst @@ -43,4 +43,43 @@ Customizing Actions-specific analysis: - **untrustedGhCommandDataModel**\(cmd_regex, flag) - **untrustedGitCommandDataModel**\(cmd_regex, flag) - **vulnerableActionsDataModel**\(action, vulnerable_version, vulnerable_sha, fixed_version) -- **workflowDataModel**\(path, trigger, job, secrets_source, permissions, runner) \ No newline at end of file +- **workflowDataModel**\(path, trigger, job, secrets_source, permissions, runner) + +Examples of custom model definitions +------------------------------------ + +The examples in this section are taken from the standard CodeQL Actions query pack published by GitHub. They demonstrate how to add tuples to extend extensible predicates that are used by the standard queries. + +Example: Extend the trusted Actions publishers for the ``actions/unpinned-tag`` query +~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ + +If there is an Action publisher that you trust, you can include the owner name/organization in a data extension model pack to add it to the allow list for this query. Adding owners to this list will prevent security alerts when using unpinned tags for Actions published by that owner. + +To allow any Action from the publisher ``octodemo``, such as ``octodemo/3rd-party-action``, follow these steps: + +1. Create a data extension file ``/models/trusted-owner.model.yml`` with the following content: + + .. code-block:: yaml + + extensions: + - addsTo: + pack: codeql/actions-all + extensible: trustedActionsOwnerDataModel + data: + - ["octodemo"] + +2. Create a model pack file ``/codeql-pack.yml`` with the following content: + + .. code-block:: yaml + + name: my-org/actions-extensions-model-pack + version: 0.0.0 + library: true + extensionTargets: + codeql/actions-all: '*' + dataExtensions: + - models/**/*.yml + +3. Ensure that the model pack is included in your CodeQL analysis. + +By following these steps, you will add ``octodemo`` to the list of trusted Action publishers, and the query will no longer generate security alerts for unpinned tags from this publisher. For more information, see `Extending CodeQL coverage with CodeQL model packs in default setup `_ and `Creating and working with CodeQL packs `_.