Handle workspace-root execution paths

Author: 1sgtpepper

actions/ql/src/Security/CWE-829/UntrustedCheckoutCritical.ql

@@ -31,9 +31,22 @@ private class ActionsCheckoutPathInput extends NormalizableFilepath {
   }
 }
 
+bindingset[path]
+private string normalizeWorkspaceExecutionPath(string path) {
+  // Only GitHub's workspace variable has known path provenance; leave other variables unresolved.
+  if path.indexOf("$GITHUB_WORKSPACE/") = 0
+  then result = path.regexpReplaceAll("^\\$GITHUB_WORKSPACE/", "GITHUB_WORKSPACE/")
+  else
+    if path.indexOf("${GITHUB_WORKSPACE}/") = 0
+    then result = path.regexpReplaceAll("^\\$\\{GITHUB_WORKSPACE\\}/", "GITHUB_WORKSPACE/")
+    else result = path
+}
+
 private class ExecutionPathInput extends NormalizableFilepath {
   ExecutionPathInput() {
-    exists(LocalScriptExecutionRunStep step | this = trimQuotes(step.getRawPath()))
+    exists(LocalScriptExecutionRunStep step |
+      this = normalizeWorkspaceExecutionPath(trimQuotes(step.getRawPath()))
+    )
     or
     exists(LocalActionUsesStep step | this = step.getCallee())
   }
@@ -57,19 +70,27 @@ private string getNormalizedActionsCheckoutPath(PRHeadCheckoutStep checkout) {
 
 bindingset[path]
 private string getNormalizedExecutionPath(string path) {
-  exists(ExecutionPathInput executionPath, string normalized |
-    executionPath = trimQuotes(path) and
+  exists(ExecutionPathInput executionPath, string rawPath, string normalized |
+    rawPath = trimQuotes(path) and
+    executionPath = normalizeWorkspaceExecutionPath(rawPath) and
     not executionPath.regexpMatch(".*\\$\\{\\{.*") and
     normalized = executionPath.getNormalizedPath() and
     not normalized.matches("/%") and
     normalized != ".." and
     not normalized.matches("../%") and
-    if normalized = "."
-    then result = "GITHUB_WORKSPACE"
-    else (
-      normalized.regexpMatch("^[^$/~].*") and
-      result = "GITHUB_WORKSPACE/" + normalized
-    )
+    if
+      rawPath.indexOf("$GITHUB_WORKSPACE/") = 0 or
+      rawPath.indexOf("${GITHUB_WORKSPACE}/") = 0
+    then
+      (normalized = "GITHUB_WORKSPACE" or normalized.matches("GITHUB_WORKSPACE/%")) and
+      result = normalized
+    else
+      if normalized = "."
+      then result = "GITHUB_WORKSPACE"
+      else (
+        normalized.regexpMatch("^[^$/~].*") and
+        result = "GITHUB_WORKSPACE/" + normalized
+      )
   )
 }
 

actions/ql/test/query-tests/Security/CWE-829/.github/workflows/untrusted_checkout_paths.yml

@@ -186,3 +186,21 @@ jobs:
           ref: ${{ github.event.pull_request.head.sha }}
           path: candidate
       - run: bash ./GITHUB_WORKSPACE/candidate/build.sh
+
+  workspace-variable-prefixes:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4.2.2
+        with:
+          repository: ${{ github.event.pull_request.head.repo.full_name }}
+          ref: ${{ github.event.pull_request.head.sha }}
+          path: candidate
+      - run: bash $GITHUB_WORKSPACE/candidate/build.sh
+      - run: bash $GITHUB_WORKSPACE/candidate-sibling/build.sh
+      - run: bash $GITHUB_WORKSPACE/candidate/../trusted.sh
+      - run: bash $GITHUB_WORKSPACE/../candidate/build.sh
+      - run: bash $OTHER_WORKSPACE/candidate/build.sh
+      - run: bash ${GITHUB_WORKSPACE}/candidate/build.sh
+      - run: bash ${GITHUB_WORKSPACE}/candidate-sibling/build.sh
+      - run: bash ${GITHUB_WORKSPACE}/candidate/../trusted.sh
+      - run: bash ${GITHUB_WORKSPACE}/../candidate/build.sh

actions/ql/test/query-tests/Security/CWE-829/UntrustedCheckoutCritical.expected

@@ -355,7 +355,16 @@ edges
 | .github/workflows/untrusted_checkout_paths.yml:153:9:158:6 | Uses Step | .github/workflows/untrusted_checkout_paths.yml:158:9:160:2 | Run Step |
 | .github/workflows/untrusted_checkout_paths.yml:163:9:168:6 | Uses Step | .github/workflows/untrusted_checkout_paths.yml:168:9:170:2 | Run Step |
 | .github/workflows/untrusted_checkout_paths.yml:173:9:178:6 | Uses Step | .github/workflows/untrusted_checkout_paths.yml:178:9:180:2 | Run Step |
-| .github/workflows/untrusted_checkout_paths.yml:183:9:188:6 | Uses Step | .github/workflows/untrusted_checkout_paths.yml:188:9:188:56 | Run Step |
+| .github/workflows/untrusted_checkout_paths.yml:183:9:188:6 | Uses Step | .github/workflows/untrusted_checkout_paths.yml:188:9:190:2 | Run Step |
+| .github/workflows/untrusted_checkout_paths.yml:193:9:198:6 | Uses Step | .github/workflows/untrusted_checkout_paths.yml:198:9:199:6 | Run Step |
+| .github/workflows/untrusted_checkout_paths.yml:198:9:199:6 | Run Step | .github/workflows/untrusted_checkout_paths.yml:199:9:200:6 | Run Step |
+| .github/workflows/untrusted_checkout_paths.yml:199:9:200:6 | Run Step | .github/workflows/untrusted_checkout_paths.yml:200:9:201:6 | Run Step |
+| .github/workflows/untrusted_checkout_paths.yml:200:9:201:6 | Run Step | .github/workflows/untrusted_checkout_paths.yml:201:9:202:6 | Run Step |
+| .github/workflows/untrusted_checkout_paths.yml:201:9:202:6 | Run Step | .github/workflows/untrusted_checkout_paths.yml:202:9:203:6 | Run Step |
+| .github/workflows/untrusted_checkout_paths.yml:202:9:203:6 | Run Step | .github/workflows/untrusted_checkout_paths.yml:203:9:204:6 | Run Step |
+| .github/workflows/untrusted_checkout_paths.yml:203:9:204:6 | Run Step | .github/workflows/untrusted_checkout_paths.yml:204:9:205:6 | Run Step |
+| .github/workflows/untrusted_checkout_paths.yml:204:9:205:6 | Run Step | .github/workflows/untrusted_checkout_paths.yml:205:9:206:6 | Run Step |
+| .github/workflows/untrusted_checkout_paths.yml:205:9:206:6 | Run Step | .github/workflows/untrusted_checkout_paths.yml:206:9:206:60 | Run Step |
 | .github/workflows/untrusted_checkout_permission_check_reusable2.yml:8:9:16:6 | Uses Step: checkAccess | .github/workflows/untrusted_checkout_permission_check_reusable2.yml:16:9:22:2 | Run Step |
 | .github/workflows/untrusted_checkout_permission_check_reusable.yml:8:9:16:6 | Uses Step: checkAccess | .github/workflows/untrusted_checkout_permission_check_reusable.yml:16:9:22:2 | Run Step |
 | .github/workflows/untrusted_checkout_permission_check_reusable_level2.yml:8:9:16:6 | Uses Step: checkAccess | .github/workflows/untrusted_checkout_permission_check_reusable_level2.yml:16:9:22:2 | Run Step |
@@ -424,5 +433,7 @@ edges
 | .github/workflows/untrusted_checkout_paths.yml:110:9:115:6 | Uses Step | .github/workflows/untrusted_checkout_paths.yml:110:9:115:6 | Uses Step | .github/workflows/untrusted_checkout_paths.yml:115:9:119:2 | Uses Step | Checkout of untrusted code in a privileged workflow with later potential execution (event trigger: $@). | .github/workflows/untrusted_checkout_paths.yml:4:3:4:21 | pull_request_target | pull_request_target |
 | .github/workflows/untrusted_checkout_paths.yml:153:9:158:6 | Uses Step | .github/workflows/untrusted_checkout_paths.yml:153:9:158:6 | Uses Step | .github/workflows/untrusted_checkout_paths.yml:158:9:160:2 | Run Step | Checkout of untrusted code in a privileged workflow with later potential execution (event trigger: $@). | .github/workflows/untrusted_checkout_paths.yml:4:3:4:21 | pull_request_target | pull_request_target |
 | .github/workflows/untrusted_checkout_paths.yml:163:9:168:6 | Uses Step | .github/workflows/untrusted_checkout_paths.yml:163:9:168:6 | Uses Step | .github/workflows/untrusted_checkout_paths.yml:168:9:170:2 | Run Step | Checkout of untrusted code in a privileged workflow with later potential execution (event trigger: $@). | .github/workflows/untrusted_checkout_paths.yml:4:3:4:21 | pull_request_target | pull_request_target |
+| .github/workflows/untrusted_checkout_paths.yml:193:9:198:6 | Uses Step | .github/workflows/untrusted_checkout_paths.yml:193:9:198:6 | Uses Step | .github/workflows/untrusted_checkout_paths.yml:198:9:199:6 | Run Step | Checkout of untrusted code in a privileged workflow with later potential execution (event trigger: $@). | .github/workflows/untrusted_checkout_paths.yml:4:3:4:21 | pull_request_target | pull_request_target |
+| .github/workflows/untrusted_checkout_paths.yml:193:9:198:6 | Uses Step | .github/workflows/untrusted_checkout_paths.yml:193:9:198:6 | Uses Step | .github/workflows/untrusted_checkout_paths.yml:203:9:204:6 | Run Step | Checkout of untrusted code in a privileged workflow with later potential execution (event trigger: $@). | .github/workflows/untrusted_checkout_paths.yml:4:3:4:21 | pull_request_target | pull_request_target |
 | .github/workflows/untrusted_checkout_permissions_check.yml:36:9:41:6 | Uses Step | .github/workflows/untrusted_checkout_permissions_check.yml:36:9:41:6 | Uses Step | .github/workflows/untrusted_checkout_permissions_check.yml:41:9:41:22 | Run Step | Checkout of untrusted code in a privileged workflow with later potential execution (event trigger: $@). | .github/workflows/untrusted_checkout_permissions_check.yml:2:3:2:21 | pull_request_target | pull_request_target |
 | .github/workflows/workflow_run_untrusted_checkout_path.yml:12:9:16:6 | Uses Step | .github/workflows/workflow_run_untrusted_checkout_path.yml:12:9:16:6 | Uses Step | .github/workflows/workflow_run_untrusted_checkout_path.yml:16:9:16:40 | Run Step | Checkout of untrusted code in a privileged workflow with later potential execution (event trigger: $@). | .github/workflows/workflow_run_untrusted_checkout_path.yml:4:3:4:14 | workflow_run | workflow_run |