Skip to content

Commit 446a2dc

Browse files
jorgectfjorgectf
committed
Add security sinks
1 parent aa62603 commit 446a2dc

99 files changed

Lines changed: 719 additions & 6 deletions

File tree

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

‎ql/lib/ext/8398a7_action-slack.model.yml‎

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,6 @@
1+
extensions:
2+
- addsTo:
3+
pack: githubsecuritylab/actions-all
4+
extensible: sinkModel
5+
data:
6+
- ["8398a7/action-slack", "*", "input.custom_payload", "code-injection"]

‎ql/lib/ext/actions_github-script.model.yml‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -3,4 +3,4 @@ extensions:
33
pack: githubsecuritylab/actions-all
44
extensible: sinkModel
55
data:
6-
- ["actions/github-script","*","input.script","expression-injection"]
6+
- ["actions/github-script", "*", "input.script", "code-injection"]

‎ql/lib/ext/akhileshns_heroku-deploy.model.yml‎

Lines changed: 15 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -4,3 +4,18 @@ extensions:
44
extensible: summaryModel
55
data:
66
- ["akhileshns/heroku-deploy", "*", "input.branch", "output.status", "taint"]
7+
- addsTo:
8+
pack: githubsecuritylab/actions-all
9+
extensible: sinkModel
10+
data:
11+
- ["akhileshns/heroku-deploy", "*", "input.heroku_app_name", "command-injection"]
12+
- ["akhileshns/heroku-deploy", "*", "input.buildpack", "command-injection"]
13+
- ["akhileshns/heroku-deploy", "*", "input.region", "command-injection"]
14+
- ["akhileshns/heroku-deploy", "*", "input.stack", "command-injection"]
15+
- ["akhileshns/heroku-deploy", "*", "input.team", "command-injection"]
16+
- ["akhileshns/heroku-deploy", "*", "input.docker_heroku_process_type", "command-injection"]
17+
- ["akhileshns/heroku-deploy", "*", "input.docker_build_args", "command-injection"]
18+
- ["akhileshns/heroku-deploy", "*", "input.branch", "command-injection"]
19+
- ["akhileshns/heroku-deploy", "*", "input.appdir", "command-injection"]
20+
- ["akhileshns/heroku-deploy", "*", "input.heroku_api_key", "command-injection"]
21+
- ["akhileshns/heroku-deploy", "*", "input.heroku_email", "command-injection"]

‎ql/lib/ext/amannn_action-semantic-pull-request.model.yml‎

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,6 @@
1+
extensions:
2+
- addsTo:
3+
pack: githubsecuritylab/actions-all
4+
extensible: sourceModel
5+
data:
6+
- ["amannn/action-semantic-pull-request", "*", "output.error_message", "pull_request_target", "PR title"]

‎ql/lib/ext/anchore_sbom-action.model.yml‎

Lines changed: 10 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,10 @@
1+
extensions:
2+
- addsTo:
3+
pack: githubsecuritylab/actions-all
4+
extensible: sinkModel
5+
data:
6+
- ["anchore/sbom-action", "*", "input.syft-version", "command-injection"]
7+
- ["anchore/sbom-action", "*", "input.format", "command-injection"]
8+
- ["anchore/sbom-action", "*", "input.path", "command-injection"]
9+
- ["anchore/sbom-action", "*", "input.file", "command-injection"]
10+
- ["anchore/sbom-action", "*", "input.image", "command-injection"]

‎ql/lib/ext/anchore_scan-action.model.yml‎

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,6 @@
1+
extensions:
2+
- addsTo:
3+
pack: githubsecuritylab/actions-all
4+
extensible: sinkModel
5+
data:
6+
- ["anchore/scan-action", "*", "input.grype-version", "command-injection"]

‎ql/lib/ext/andresz1_size-limit-action.model.yml‎

Lines changed: 9 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,9 @@
1+
extensions:
2+
- addsTo:
3+
pack: githubsecuritylab/actions-all
4+
extensible: sinkModel
5+
data:
6+
- ["andresz1/size-limit-action", "*", "input.package_manager", "command-injection"]
7+
- ["andresz1/size-limit-action", "*", "input.build_script", "command-injection"]
8+
- ["andresz1/size-limit-action", "*", "input.script", "command-injection"]
9+
- ["andresz1/size-limit-action", "*", "input.clean_script", "command-injection"]

‎ql/lib/ext/asdf-vm_actions.model.yml‎

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,6 @@
1+
extensions:
2+
- addsTo:
3+
pack: githubsecuritylab/actions-all
4+
extensible: sinkModel
5+
data:
6+
- ["asdf-vm/actions", "*", "input.before_install", "command-injection"]

‎ql/lib/ext/axel-op_googlejavaformat-action.model.yml‎

Lines changed: 7 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,7 @@
1+
extensions:
2+
- addsTo:
3+
pack: githubsecuritylab/actions-all
4+
extensible: sinkModel
5+
data:
6+
- ["axel-op/googlejavaformat-action", "*", "input.commitMessage", "command-injection"]
7+
- ["axel-op/googlejavaformat-action", "*", "input.commit-message", "command-injection"]

‎ql/lib/ext/azure_powershell.model.yml‎

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,6 @@
1+
extensions:
2+
- addsTo:
3+
pack: githubsecuritylab/actions-all
4+
extensible: sinkModel
5+
data:
6+
- ["azure/powershell", "*", "input.azPSVersion", "command-injection"]

0 commit comments

Comments
 (0)