Skip to content

Commit 02dc767

Browse files
1sgtpepper1sgtpepper
committed
Fix untrusted checkout path normalization
1 parent 5690ec7 commit 02dc767

5 files changed

Lines changed: 74 additions & 2 deletions

File tree

‎actions/ql/lib/codeql/actions/security/UntrustedCheckoutQuery.qll‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -259,7 +259,7 @@ class ActionsMutableRefCheckout extends MutableRefCheckoutStep instanceof UsesSt
259259

260260
override string getPath() {
261261
if exists(this.(UsesStep).getArgument("path"))
262-
then result = this.(UsesStep).getArgument("path")
262+
then result = normalizePath(this.(UsesStep).getArgument("path"))
263263
else result = "GITHUB_WORKSPACE/"
264264
}
265265
}
@@ -294,7 +294,7 @@ class ActionsSHACheckout extends SHACheckoutStep instanceof UsesStep {
294294

295295
override string getPath() {
296296
if exists(this.(UsesStep).getArgument("path"))
297-
then result = this.(UsesStep).getArgument("path")
297+
then result = normalizePath(this.(UsesStep).getArgument("path"))
298298
else result = "GITHUB_WORKSPACE/"
299299
}
300300
}

‎actions/ql/src/change-notes/2026-07-21-untrusted-checkout-paths.md‎

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,4 @@
1+
---
2+
category: minorAnalysis
3+
---
4+
* The `actions/untrusted-checkout/critical` query now recognizes local scripts and actions run from an explicit relative `actions/checkout` path.

‎actions/ql/test/query-tests/Security/CWE-829/.github/workflows/untrusted_checkout_paths.yml‎

Lines changed: 42 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,42 @@
1+
name: Untrusted checkout paths
2+
3+
on:
4+
issue_comment:
5+
types: [created]
6+
7+
jobs:
8+
bare-path:
9+
runs-on: ubuntu-latest
10+
steps:
11+
- uses: actions/checkout@v4.2.2
12+
with:
13+
ref: ${{ github.head_ref }}
14+
path: checkout
15+
- run: ./checkout/build.sh
16+
17+
dot-relative-path:
18+
runs-on: ubuntu-latest
19+
steps:
20+
- uses: actions/checkout@v4.2.2
21+
with:
22+
ref: ${{ github.head_ref }}
23+
path: ./checkout-dot
24+
- run: bash ./checkout-dot/build.sh
25+
26+
trailing-slash-path:
27+
runs-on: ubuntu-latest
28+
steps:
29+
- uses: actions/checkout@v4.2.2
30+
with:
31+
ref: ${{ github.head_ref }}
32+
path: checkout-action/
33+
- uses: ./checkout-action/.github/actions/build
34+
35+
nested-quoted-path:
36+
runs-on: ubuntu-latest
37+
steps:
38+
- uses: actions/checkout@v4.2.2
39+
with:
40+
ref: ${{ github.head_ref }}
41+
path: "a/b"
42+
- run: bash ./a/b/build.sh

‎actions/ql/test/query-tests/Security/CWE-829/.github/workflows/workflow_run_untrusted_checkout_path.yml‎

Lines changed: 16 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,16 @@
1+
name: Workflow run untrusted checkout path
2+
3+
on:
4+
workflow_run:
5+
workflows: [Test]
6+
types: [completed]
7+
8+
jobs:
9+
nested-path:
10+
runs-on: ubuntu-latest
11+
steps:
12+
- uses: actions/checkout@v4.2.2
13+
with:
14+
ref: ${{ github.event.workflow_run.head_sha }}
15+
path: nested/checkout
16+
- run: ./nested/checkout/build.sh

‎actions/ql/test/query-tests/Security/CWE-829/UntrustedCheckoutCritical.expected‎

Lines changed: 10 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -338,6 +338,10 @@ edges
338338
| .github/workflows/untrusted_checkout_6.yml:17:9:21:6 | Uses Step | .github/workflows/untrusted_checkout_6.yml:21:9:23:23 | Run Step |
339339
| .github/workflows/untrusted_checkout_no_needs.yml:8:9:16:6 | Uses Step: checkAccess | .github/workflows/untrusted_checkout_no_needs.yml:16:9:22:2 | Run Step |
340340
| .github/workflows/untrusted_checkout_no_needs.yml:26:9:31:6 | Uses Step | .github/workflows/untrusted_checkout_no_needs.yml:31:9:31:23 | Run Step |
341+
| .github/workflows/untrusted_checkout_paths.yml:11:9:15:6 | Uses Step | .github/workflows/untrusted_checkout_paths.yml:15:9:17:2 | Run Step |
342+
| .github/workflows/untrusted_checkout_paths.yml:20:9:24:6 | Uses Step | .github/workflows/untrusted_checkout_paths.yml:24:9:26:2 | Run Step |
343+
| .github/workflows/untrusted_checkout_paths.yml:29:9:33:6 | Uses Step | .github/workflows/untrusted_checkout_paths.yml:33:9:35:2 | Uses Step |
344+
| .github/workflows/untrusted_checkout_paths.yml:38:9:42:6 | Uses Step | .github/workflows/untrusted_checkout_paths.yml:42:9:42:33 | Run Step |
341345
| .github/workflows/untrusted_checkout_permission_check_reusable2.yml:8:9:16:6 | Uses Step: checkAccess | .github/workflows/untrusted_checkout_permission_check_reusable2.yml:16:9:22:2 | Run Step |
342346
| .github/workflows/untrusted_checkout_permission_check_reusable.yml:8:9:16:6 | Uses Step: checkAccess | .github/workflows/untrusted_checkout_permission_check_reusable.yml:16:9:22:2 | Run Step |
343347
| .github/workflows/untrusted_checkout_permission_check_reusable_level2.yml:8:9:16:6 | Uses Step: checkAccess | .github/workflows/untrusted_checkout_permission_check_reusable_level2.yml:16:9:22:2 | Run Step |
@@ -350,6 +354,7 @@ edges
350354
| .github/workflows/workflow_run_untrusted_checkout.yml:13:9:16:6 | Uses Step | .github/workflows/workflow_run_untrusted_checkout.yml:16:9:18:31 | Uses Step |
351355
| .github/workflows/workflow_run_untrusted_checkout_2.yml:13:9:16:6 | Uses Step | .github/workflows/workflow_run_untrusted_checkout_2.yml:16:9:18:31 | Uses Step |
352356
| .github/workflows/workflow_run_untrusted_checkout_3.yml:13:9:16:6 | Uses Step | .github/workflows/workflow_run_untrusted_checkout_3.yml:16:9:18:31 | Uses Step |
357+
| .github/workflows/workflow_run_untrusted_checkout_path.yml:12:9:16:6 | Uses Step | .github/workflows/workflow_run_untrusted_checkout_path.yml:16:9:16:40 | Run Step |
353358
#select
354359
| .github/actions/dangerous-git-checkout/action.yml:6:7:11:4 | Uses Step | .github/actions/dangerous-git-checkout/action.yml:6:7:11:4 | Uses Step | .github/workflows/untrusted_checkout3.yml:13:9:13:23 | Run Step | Checkout of untrusted code in a privileged workflow with later potential execution (event trigger: $@). | .github/workflows/untrusted_checkout3.yml:4:3:4:14 | workflow_run | workflow_run |
355360
| .github/workflows/auto_ci.yml:20:9:27:6 | Uses Step | .github/workflows/auto_ci.yml:20:9:27:6 | Uses Step | .github/workflows/auto_ci.yml:32:9:37:6 | Run Step | Checkout of untrusted code in a privileged workflow with later potential execution (event trigger: $@). | .github/workflows/auto_ci.yml:6:3:6:21 | pull_request_target | pull_request_target |
@@ -394,4 +399,9 @@ edges
394399
| .github/workflows/untrusted_checkout.yml:8:9:11:6 | Uses Step | .github/workflows/untrusted_checkout.yml:8:9:11:6 | Uses Step | .github/workflows/untrusted_checkout.yml:15:9:18:2 | Run Step | Checkout of untrusted code in a privileged workflow with later potential execution (event trigger: $@). | .github/workflows/untrusted_checkout.yml:2:3:2:21 | pull_request_target | pull_request_target |
395400
| .github/workflows/untrusted_checkout.yml:23:9:26:6 | Uses Step | .github/workflows/untrusted_checkout.yml:23:9:26:6 | Uses Step | .github/workflows/untrusted_checkout.yml:30:9:32:23 | Run Step | Checkout of untrusted code in a privileged workflow with later potential execution (event trigger: $@). | .github/workflows/untrusted_checkout.yml:2:3:2:21 | pull_request_target | pull_request_target |
396401
| .github/workflows/untrusted_checkout_no_needs.yml:26:9:31:6 | Uses Step | .github/workflows/untrusted_checkout_no_needs.yml:26:9:31:6 | Uses Step | .github/workflows/untrusted_checkout_no_needs.yml:31:9:31:23 | Run Step | Checkout of untrusted code in a privileged workflow with later potential execution (event trigger: $@). | .github/workflows/untrusted_checkout_no_needs.yml:2:3:2:21 | pull_request_target | pull_request_target |
402+
| .github/workflows/untrusted_checkout_paths.yml:11:9:15:6 | Uses Step | .github/workflows/untrusted_checkout_paths.yml:11:9:15:6 | Uses Step | .github/workflows/untrusted_checkout_paths.yml:15:9:17:2 | Run Step | Checkout of untrusted code in a privileged workflow with later potential execution (event trigger: $@). | .github/workflows/untrusted_checkout_paths.yml:4:3:4:15 | issue_comment | issue_comment |
403+
| .github/workflows/untrusted_checkout_paths.yml:20:9:24:6 | Uses Step | .github/workflows/untrusted_checkout_paths.yml:20:9:24:6 | Uses Step | .github/workflows/untrusted_checkout_paths.yml:24:9:26:2 | Run Step | Checkout of untrusted code in a privileged workflow with later potential execution (event trigger: $@). | .github/workflows/untrusted_checkout_paths.yml:4:3:4:15 | issue_comment | issue_comment |
404+
| .github/workflows/untrusted_checkout_paths.yml:29:9:33:6 | Uses Step | .github/workflows/untrusted_checkout_paths.yml:29:9:33:6 | Uses Step | .github/workflows/untrusted_checkout_paths.yml:33:9:35:2 | Uses Step | Checkout of untrusted code in a privileged workflow with later potential execution (event trigger: $@). | .github/workflows/untrusted_checkout_paths.yml:4:3:4:15 | issue_comment | issue_comment |
405+
| .github/workflows/untrusted_checkout_paths.yml:38:9:42:6 | Uses Step | .github/workflows/untrusted_checkout_paths.yml:38:9:42:6 | Uses Step | .github/workflows/untrusted_checkout_paths.yml:42:9:42:33 | Run Step | Checkout of untrusted code in a privileged workflow with later potential execution (event trigger: $@). | .github/workflows/untrusted_checkout_paths.yml:4:3:4:15 | issue_comment | issue_comment |
397406
| .github/workflows/untrusted_checkout_permissions_check.yml:36:9:41:6 | Uses Step | .github/workflows/untrusted_checkout_permissions_check.yml:36:9:41:6 | Uses Step | .github/workflows/untrusted_checkout_permissions_check.yml:41:9:41:22 | Run Step | Checkout of untrusted code in a privileged workflow with later potential execution (event trigger: $@). | .github/workflows/untrusted_checkout_permissions_check.yml:2:3:2:21 | pull_request_target | pull_request_target |
407+
| .github/workflows/workflow_run_untrusted_checkout_path.yml:12:9:16:6 | Uses Step | .github/workflows/workflow_run_untrusted_checkout_path.yml:12:9:16:6 | Uses Step | .github/workflows/workflow_run_untrusted_checkout_path.yml:16:9:16:40 | Run Step | Checkout of untrusted code in a privileged workflow with later potential execution (event trigger: $@). | .github/workflows/workflow_run_untrusted_checkout_path.yml:4:3:4:14 | workflow_run | workflow_run |

0 commit comments

Comments
 (0)