Skip to content
Permalink
v2.2.7
Switch branches/tags

Name already in use

A tag already exists with the provided branch name. Many Git commands accept both tag and branch names, so creating this branch may cause unexpected behavior. Are you sure you want to create this branch?
Go to file
 
 
Cannot retrieve contributors at this time
24 lines (21 sloc) 1001 Bytes
/**
* @name Import action entrypoint
* @description Importing the entrypoint file for an action is dangerous
* because the code from that action will be run when the file is imported.
* @kind problem
* @problem.severity error
* @id javascript/codeql-action/import-action-entrypoint
*/
import javascript
class ActionEntrypointFile extends File {
ActionEntrypointFile() {
exists(Module m | m.getPath() = this.getAbsolutePath() and
// This is quite a broad check and relies on the function name, but hopefully it'll be accurate enough
m.getAStmt().getAChildExpr+().(CallExpr).getCalleeName() = "run") and
// Requiring the relative path to exist limits us to files in the code repository and avoid libraries
exists(this.getRelativePath())
}
}
from ImportDeclaration i
where exists(ActionEntrypointFile f | i.getImportedModule().getPath() = f.getAbsolutePath())
select i, "This imports the entrypoint file for an action. This will execute the code from the action."