Skip to content

Add mono-repo filtering example using a workflow matrix #1

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom
Open
wants to merge 8 commits into
base: main
Choose a base branch
from
Open

Add mono-repo filtering example using a workflow matrix #1

wants to merge 8 commits into from

Conversation

@nicolaswill
Copy link

@nicolaswill nicolaswill commented Jan 11, 2024

No description provided.

@nicolaswill nicolaswill requested a review from aegilops as a code owner January 11, 2024 11:36
@github-advanced-security
Copy link

github-advanced-security bot commented Jan 11, 2024

This pull request sets up GitHub code scanning for this repository. Once the scans have completed and the checks have passed, the analysis results for this pull request branch will appear on this overview. Once you merge this pull request, the 'Security' tab will show more code scanning analysis results (for example, for the default branch). Depending on your configuration and choice of analysis tool, future pull requests will be annotated with code scanning analysis results. For more information about GitHub code scanning, check out the documentation.

github-advanced-security[bot]
github-advanced-security bot found potential problems Jan 11, 2024
View reviewed changes
project5/test.js
var server = http.createServer(function(req, res) {
let path = url.parse(req.url, true).query.path;

fs.readFileSync(path); // NOT OK

Check failure

Code scanning / CodeQL-project5-javascript

Uncontrolled data used in path expression

This path depends on a [user-provided value](1).
project5/test.js

var obj = bla ? something() : path;

fs.readFileSync(obj.sub); // NOT OK

Check failure

Code scanning / CodeQL-project5-javascript

Uncontrolled data used in path expression

This path depends on a [user-provided value](1).
project5/test.js
if (random()) {
obj.sub3 = "safe"
}
fs.readFileSync(obj.sub3); // NOT OK

Check failure

Code scanning / CodeQL-project5-javascript

Uncontrolled data used in path expression

This path depends on a [user-provided value](1).
project5/test.js
fs.readFileSync(obj.sub3); // NOT OK

obj.sub4 =
fs.readFileSync(obj.sub4) ? // NOT OK

Check failure

Code scanning / CodeQL-project5-javascript

Uncontrolled data used in path expression

This path depends on a [user-provided value](1).
project5/test.js

obj.sub4 =
fs.readFileSync(obj.sub4) ? // NOT OK
fs.readFileSync(obj.sub4) : // NOT OK

Check failure

Code scanning / CodeQL-project5-javascript

Uncontrolled data used in path expression

This path depends on a [user-provided value](1).
project5/test.js
obj.sub4 =
fs.readFileSync(obj.sub4) ? // NOT OK
fs.readFileSync(obj.sub4) : // NOT OK
fs.readFileSync(obj.sub4); // NOT OK

Check failure

Code scanning / CodeQL-project5-javascript

Uncontrolled data used in path expression

This path depends on a [user-provided value](1).
project5/test.js

var server2 = http.createServer(function(req, res) {
let path = url.parse(req.url, true).query.path;
nodefs.readFileSync(path); // NOT OK

Check failure

Code scanning / CodeQL-project5-javascript

Uncontrolled data used in path expression

This path depends on a [user-provided value](1).
project5/test.js

var server3 = http.createServer(function (req, res) {
let path = url.parse(req.url, true).query.path;
chownr(path, "someuid", "somegid", function (err) {}); // NOT OK

Check failure

Code scanning / CodeQL-project5-javascript

Uncontrolled data used in path expression

This path depends on a [user-provided value](1).
project5/test.js

const chownr = require("chownr");

var server3 = http.createServer(function (req, res) {

Check notice

Code scanning / CodeQL-project5-javascript

Unused variable, import, function or class

Unused variable server3.
project5/test.js
}

if (random()) {
obj.sub3 = "safe"

Check notice

Code scanning / CodeQL-project5-javascript

Semicolon insertion

Avoid automated semicolon insertion (90% of all statements in [the enclosing function](1) have an explicit semicolon).
github-advanced-security[bot]
github-advanced-security bot found potential problems Jan 11, 2024
View reviewed changes
project6/UnsafeDynamicMethodAccess.js

window.addEventListener('message', (ev) => {
let message = JSON.parse(ev.data);
window[message.name](message.payload); // NOT OK, but reported by UnsafeDynamicMethodAccess.ql [INCONSISTENCY]

Check failure

Code scanning / CodeQL-project6-javascript

Unsafe dynamic method access

This method is invoked using a [user-controlled value](1), which may allow remote code execution.
project6/UnsafeDynamicMethodAccess.js
window.addEventListener('message', (ev) => {
let message = JSON.parse(ev.data);
window[message.name](message.payload); // NOT OK, but reported by UnsafeDynamicMethodAccess.ql [INCONSISTENCY]
new window[message.name](message.payload); // NOT OK, but reported by UnsafeDynamicMethodAccess.ql [INCONSISTENCY]

Check failure

Code scanning / CodeQL-project6-javascript

Unsafe dynamic method access

This method is invoked using a [user-controlled value](1), which may allow remote code execution.
project6/UnsafeDynamicMethodAccess.js
window[`HTMLElement${message.name}`](message.payload); // OK - concatenation restricts choice of methods

function f() {}
f[message.name](message.payload)(); // NOT OK, but reported by UnsafeDynamicMethodAccess.ql [INCONSISTENCY]

Check failure

Code scanning / CodeQL-project6-javascript

Unsafe dynamic method access

This method is invoked using a [user-controlled value](1), which may allow remote code execution.
project6/UnsafeDynamicMethodAccess.js

obj[message.name](message.payload); // NOT OK

window[ev](ev); // NOT OK, but reported by UnsafeDynamicMethodAccess.ql [INCONSISTENCY]

Check failure

Code scanning / CodeQL-project6-javascript

Unsafe dynamic method access

This method is invoked using a [user-controlled value](1), which may allow remote code execution.
project6/UnsafeDynamicMethodAccess.js
function f() {}
f[message.name](message.payload)(); // NOT OK, but reported by UnsafeDynamicMethodAccess.ql [INCONSISTENCY]

obj[message.name](message.payload); // NOT OK

Check failure

Code scanning / CodeQL-project6-javascript

Unvalidated dynamic method call

Invocation of method with [user-controlled](1) name may dispatch to unexpected target and cause an exception.
project6/UnsafeDynamicMethodAccess.js

let obj = {};

window.addEventListener('message', (ev) => {

Check warning

Code scanning / CodeQL-project6-javascript

Missing origin verification in `postMessage` handler

Postmessage handler has no origin check.
github-advanced-security[bot]
github-advanced-security bot found potential problems Jan 11, 2024
View reviewed changes
project5/test.js

var server2 = http.createServer(function(req, res) {
let path = url.parse(req.url, true).query.path;
nodefs.readFileSync(path); // NOT OK

Check failure

Code scanning / CodeQL-project5-javascript

Uncontrolled data used in path expression

This path depends on a [user-provided value](1).
project5/test.js

var server3 = http.createServer(function (req, res) {
let path = url.parse(req.url, true).query.path;
chownr(path, "someuid", "somegid", function (err) {}); // NOT OK

Check failure

Code scanning / CodeQL-project5-javascript

Uncontrolled data used in path expression

This path depends on a [user-provided value](1).
project5/test.js
}

if (random()) {
obj.sub3 = "safe"

Check notice

Code scanning / CodeQL-project5-javascript

Semicolon insertion

Avoid automated semicolon insertion (90% of all statements in [the enclosing function](1) have an explicit semicolon).
project5/test.js

const chownr = require("chownr");

var server3 = http.createServer(function (req, res) {

Check notice

Code scanning / CodeQL-project5-javascript

Unused variable, import, function or class

Unused variable server3.
github-advanced-security[bot]
github-advanced-security bot found potential problems Jan 11, 2024
View reviewed changes
project6/UnsafeDynamicMethodAccess.js
function f() {}
f[message.name](message.payload)(); // NOT OK, but reported by UnsafeDynamicMethodAccess.ql [INCONSISTENCY]

obj[message.name](message.payload); // NOT OK

Check failure

Code scanning / CodeQL-project6-javascript

Unvalidated dynamic method call

Invocation of method with [user-controlled](1) name may dispatch to unexpected target and cause an exception.
project6/UnsafeDynamicMethodAccess.js

window.addEventListener('message', (ev) => {
let message = JSON.parse(ev.data);
window[message.name](message.payload); // NOT OK, but reported by UnsafeDynamicMethodAccess.ql [INCONSISTENCY]

Check failure

Code scanning / CodeQL-project6-javascript

Unsafe dynamic method access

This method is invoked using a [user-controlled value](1), which may allow remote code execution.
project6/UnsafeDynamicMethodAccess.js
window.addEventListener('message', (ev) => {
let message = JSON.parse(ev.data);
window[message.name](message.payload); // NOT OK, but reported by UnsafeDynamicMethodAccess.ql [INCONSISTENCY]
new window[message.name](message.payload); // NOT OK, but reported by UnsafeDynamicMethodAccess.ql [INCONSISTENCY]

Check failure

Code scanning / CodeQL-project6-javascript

Unsafe dynamic method access

This method is invoked using a [user-controlled value](1), which may allow remote code execution.
project6/UnsafeDynamicMethodAccess.js
window[`HTMLElement${message.name}`](message.payload); // OK - concatenation restricts choice of methods

function f() {}
f[message.name](message.payload)(); // NOT OK, but reported by UnsafeDynamicMethodAccess.ql [INCONSISTENCY]

Check failure

Code scanning / CodeQL-project6-javascript

Unsafe dynamic method access

This method is invoked using a [user-controlled value](1), which may allow remote code execution.
project6/UnsafeDynamicMethodAccess.js

obj[message.name](message.payload); // NOT OK

window[ev](ev); // NOT OK, but reported by UnsafeDynamicMethodAccess.ql [INCONSISTENCY]

Check failure

Code scanning / CodeQL-project6-javascript

Unsafe dynamic method access

This method is invoked using a [user-controlled value](1), which may allow remote code execution.
project6/UnsafeDynamicMethodAccess.js

let obj = {};

window.addEventListener('message', (ev) => {

Check warning

Code scanning / CodeQL-project6-javascript

Missing origin verification in `postMessage` handler

Postmessage handler has no origin check.
@nicolaswill nicolaswill changed the title Kraiouchkine patch 1 Add mono-repo filtering example using a workflow matrix Jan 11, 2024
aegilops
aegilops requested changes Jan 12, 2024
View reviewed changes
Copy link
Collaborator

@aegilops aegilops left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Looks good, thanks! One specific change, checkout up to v4, other than that it looks fine and seems to be working

.github/workflows/codeql_mono.yml Outdated

steps:
- name: Checkout repository
uses: actions/checkout@v3
Copy link
Collaborator

@aegilops aegilops Jan 12, 2024

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Can you bump that to v4 please?

felickz
felickz reviewed Sep 10, 2024
View reviewed changes
@nicolaswill
Copy link
Author

nicolaswill commented Sep 10, 2024

Thanks @aegilops & @felickz, just got around to updating this PR.

@aegilops
Copy link
Collaborator

aegilops commented Sep 13, 2024

I can't merge this PR, since there's a branch protection rule preventing me from merging, due to the deliberate (example) vulnerabilities

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@felickz felickz felickz left review comments

@aegilops aegilops aegilops requested changes

Requested changes must be addressed to merge this pull request.

Assignees

No one assigned

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

3 participants

@nicolaswill @aegilops @felickz