CodeQL library for GitHub Actions
codeql/actions-all 0.4.27-dev (changelog, source)
Search

Module Bash

Import path

import actions

Predicates

alphaNumericRegex

Holds if the given regex is used to match an alphanumeric string eg: ^[0-9a-zA-Z]{40}$, ^[0-9]+$ or ^[a-zA-Z0-9_]+$

blockFileWrite
cmdReachingArgumentInjectionSink
cmdReachingGitHubFileWrite

Holds if the Run scripts contains a command substitution (cmd) which output may get appended to the GITHUB_XXX special file

cmdReachingRunExpr

Holds if a command output is used, directly or indirectly, in a Run’s step expression. Where the expression is a string captured from the Run’s script.

commandSeparator
containsCmdSubstitution

Checks if expr is a bash command substitution

containsParameterExpansion
envReachingArgumentInjectionSink
envReachingGitHubFileWrite

Holds if the Run scripts contains an access to an environment variable called var which value may get appended to the GITHUB_XXX special file

envReachingRunExpr

Holds if and environment variable is used, directly or indirectly, in a Run’s step expression. Where the expression is a string captured from the Run’s script.

extractFileWrite
extractVariableAndValue
fileReadCommand
fileToFileWrite

Writes the content of the file specified by path into a file pointed to by file_var

heredocFileWrite
isCmdSubstitution

Checks if expr is a bash command substitution

isParameterExpansion

Checks if expr is a bash parameter expansion

linesFileWrite
multiLineFileWrite
pipeSeparator
redirectionSeparator
separator
singleLineFileWrite
singleLineWorkflowCmd
splitSeparator
stmtSeparator
varMatchesRegexTest

Holds if there test command that checks a variable against a regex eg: [[ $VAR =~ ^[a-zA-Z0-9_]+$ ]]