Skip to content

Commit d31896b

Browse files
adityasharadadityasharad
authored
Merge pull request #19166 from yoff/actions/add-actions-permissions-MaD-model
actions: add MaD model for permissions needed by actions
2 parents d513012 + c185290 commit d31896b

File tree

8 files changed

+108
-6
lines changed

8 files changed

+108
-6
lines changed

‎actions/ql/lib/codeql/actions/config/Config.qll

+10
Original file line numberDiff line numberDiff line change
@@ -154,3 +154,13 @@ predicate untrustedGitCommandDataModel(string cmd_regex, string flag) {
154154
predicate untrustedGhCommandDataModel(string cmd_regex, string flag) {
155155
Extensions::untrustedGhCommandDataModel(cmd_regex, flag)
156156
}
157+
158+
/**
159+
* MaD models for permissions needed by actions
160+
* Fields:
161+
* - action: action name, e.g. `actions/checkout`
162+
* - permission: permission name, e.g. `contents: read`
163+
*/
164+
predicate actionsPermissionsDataModel(string action, string permission) {
165+
Extensions::actionsPermissionsDataModel(action, permission)
166+
}

‎actions/ql/lib/codeql/actions/config/ConfigExtensions.qll

+11
Original file line numberDiff line numberDiff line change
@@ -77,3 +77,14 @@ extensible predicate untrustedGitCommandDataModel(string cmd_regex, string flag)
7777
* Holds for gh commands that may introduce untrusted data
7878
*/
7979
extensible predicate untrustedGhCommandDataModel(string cmd_regex, string flag);
80+
81+
/**
82+
* Holds if `action` needs `permission` to run.
83+
* - 'action' is the name of the action without any version information.
84+
* E.g. for the action selector `actions/checkout@v2`, `action` is `actions/checkout`.
85+
* - `permission` is of the form `scope-name: read|write`, for example `contents: read`.
86+
* - see https://github.com/actions/checkout?tab=readme-ov-file#recommended-permissions
87+
* for an example of recommended permissions.
88+
* - see https://docs.github.com/en/actions/writing-workflows/choosing-what-your-workflow-does/controlling-permissions-for-github_token for documentation of token permissions.
89+
*/
90+
extensible predicate actionsPermissionsDataModel(string action, string permission);

‎actions/ql/lib/ext/config/actions_permissions.yml

+37
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,37 @@
1+
extensions:
2+
- addsTo:
3+
pack: codeql/actions-all
4+
extensible: actionsPermissionsDataModel
5+
data:
6+
- ["actions/checkout", "contents: read"]
7+
- ["actions/setup-node", "contents: read"]
8+
- ["actions/setup-python", "contents: read"]
9+
- ["actions/setup-java", "contents: read"]
10+
- ["actions/setup-go", "contents: read"]
11+
- ["actions/setup-dotnet", "contents: read"]
12+
- ["actions/labeler", "contents: read"]
13+
- ["actions/labeler", "pull-requests: write"]
14+
- ["actions/attest", "id-token: write"]
15+
- ["actions/attest", "attestations: write"]
16+
# No permissions needed for actions/add-to-project
17+
- ["actions/dependency-review-action", "contents: read"]
18+
- ["actions/attest-sbom", "id-token: write"]
19+
- ["actions/attest-sbom", "attestations: write"]
20+
- ["actions/stale", "contents: write"]
21+
- ["actions/stale", "issues: write"]
22+
- ["actions/stale", "pull-requests: write"]
23+
- ["actions/attest-build-provenance", "id-token: write"]
24+
- ["actions/attest-build-provenance", "attestations: write"]
25+
- ["actions/jekyll-build-pages", "contents: read"]
26+
- ["actions/jekyll-build-pages", "pages: write"]
27+
- ["actions/jekyll-build-pages", "id-token: write"]
28+
- ["actions/publish-action", "contents: write"]
29+
- ["actions/versions-package-tools", "contents: read"]
30+
- ["actions/versions-package-tools", "actions: read"]
31+
- ["actions/reusable-workflows", "contents: read"]
32+
- ["actions/reusable-workflows", "actions: read"]
33+
# TODO: Add permissions for actions/download-artifact
34+
# TODO: Add permissions for actions/upload-artifact
35+
# TODO: Add permissions for actions/cache
36+
37+

‎actions/ql/src/Security/CWE-275/MissingActionsPermissions.ql

+18-3
Original file line numberDiff line numberDiff line change
@@ -14,13 +14,28 @@
1414

1515
import actions
1616

17-
from Job job
17+
Step stepInJob(Job job) { result = job.(LocalJob).getAStep() }
18+
19+
string jobNeedsPermission(Job job) {
20+
actionsPermissionsDataModel(stepInJob(job).(UsesStep).getCallee(), result)
21+
}
22+
23+
/** Gets a suggestion for the minimal token permissions for `job`, as a JSON string. */
24+
string permissionsForJob(Job job) {
25+
result =
26+
"{" + concat(string permission | permission = jobNeedsPermission(job) | permission, ", ") + "}"
27+
}
28+
29+
from Job job, string permissions
1830
where
1931
not exists(job.getPermissions()) and
2032
not exists(job.getEnclosingWorkflow().getPermissions()) and
2133
// exists a trigger event that is not a workflow_call
2234
exists(Event e |
2335
e = job.getATriggerEvent() and
2436
not e.getName() = "workflow_call"
25-
)
26-
select job, "Actions Job or Workflow does not set permissions"
37+
) and
38+
permissions = permissionsForJob(job)
39+
select job,
40+
"Actions job or workflow does not limit the permissions of the GITHUB_TOKEN. Consider setting an explicit permissions block, using the following as a minimal starting point: "
41+
+ permissions

‎actions/ql/src/change-notes/2025-02-04-suggest-actions-permissions.md

+4
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,4 @@
1+
---
2+
category: fix
3+
---
4+
* Alerts produced by the query `actions/missing-workflow-permissions` now include a minimal set of recommended permissions in the alert message, based on well-known actions seen within the workflow file.

‎actions/ql/test/query-tests/Security/CWE-275/.github/workflows/perms6.yml

+13
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,13 @@
1+
on:
2+
workflow_call:
3+
workflow_dispatch:
4+
5+
jobs:
6+
build:
7+
name: Build and test
8+
runs-on: ubuntu-latest
9+
steps:
10+
- uses: actions/checkout@v2
11+
- uses: actions/jekyll-build-pages
12+
13+

‎actions/ql/test/query-tests/Security/CWE-275/.github/workflows/perms7.yml

+10
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,10 @@
1+
on:
2+
workflow_call:
3+
workflow_dispatch:
4+
5+
jobs:
6+
build:
7+
name: Build and test
8+
runs-on: ubuntu-latest
9+
steps:
10+
- uses: actions/add-to-project@v2

‎actions/ql/test/query-tests/Security/CWE-275/MissingActionsPermissions.expected

+5-3
Original file line numberDiff line numberDiff line change
@@ -1,3 +1,5 @@
1-
| .github/workflows/perms1.yml:6:5:9:32 | Job: build | Actions Job or Workflow does not set permissions |
2-
| .github/workflows/perms2.yml:6:5:10:2 | Job: build | Actions Job or Workflow does not set permissions |
3-
| .github/workflows/perms5.yml:7:5:10:32 | Job: build | Actions Job or Workflow does not set permissions |
1+
| .github/workflows/perms1.yml:6:5:9:32 | Job: build | Actions job or workflow does not limit the permissions of the GITHUB_TOKEN. Consider setting an explicit permissions block, using the following as a minimal starting point: {contents: read} |
2+
| .github/workflows/perms2.yml:6:5:10:2 | Job: build | Actions job or workflow does not limit the permissions of the GITHUB_TOKEN. Consider setting an explicit permissions block, using the following as a minimal starting point: {contents: read} |
3+
| .github/workflows/perms5.yml:7:5:10:32 | Job: build | Actions job or workflow does not limit the permissions of the GITHUB_TOKEN. Consider setting an explicit permissions block, using the following as a minimal starting point: {contents: read} |
4+
| .github/workflows/perms6.yml:7:5:11:39 | Job: build | Actions job or workflow does not limit the permissions of the GITHUB_TOKEN. Consider setting an explicit permissions block, using the following as a minimal starting point: {contents: read, id-token: write, pages: write} |
5+
| .github/workflows/perms7.yml:7:5:10:38 | Job: build | Actions job or workflow does not limit the permissions of the GITHUB_TOKEN. Consider setting an explicit permissions block, using the following as a minimal starting point: {} |

0 commit comments

Comments
 (0)