|
| 1 | +# Exercise 6 - Enhance the detection of vulnerabilities using third party queries |
| 2 | +We know CodeQL is a perfect tool for detecting vulnerablities because: |
| 3 | +- It helps us to treat Workflows as code |
| 4 | +- Treat code as data and extract it into a database |
| 5 | +- Look for known vulnerabilities using built-in queries |
| 6 | +- Create custom queries and expand coverage; |
| 7 | +- Use code scanning to create alerts |
| 8 | +- Use actions to block PRs |
| 9 | +- Use deployment protection rules to block jobs |
| 10 | + |
| 11 | +In the next exercise we will explore how to expand the coverage by using third party queries to detect `unpinned` actions. |
| 12 | + |
| 13 | +## Unpinned Actions |
| 14 | +The individual jobs in a GitHub Actions workflow can interact with (and compromise) other jobs. For example, a job querying the environment variables used by a later job, writing files to a shared directory that a later job processes, or even more directly by interacting with the Docker socket and inspecting other running containers and executing commands in them. This means that a compromise of a single action within a workflow can be very significant, as that compromised action would have access to all secrets configured on your repository, and may be able to use the GITHUB_TOKEN to write to the repository. Consequently, there is significant risk in sourcing actions from third-party repositories on GitHub. For information on some of the steps an attacker could take, see [Security hardening for GitHub Actions.](https://docs.github.com/en/enterprise-cloud@latest/actions/security-guides/security-hardening-for-github-actions#using-third-party-actions) |
| 15 | + |
| 16 | +GitHub's Field Team's has built Custom CodeQL Queries, Suites, and Configurations to address several vulnerabilities and they have a query for `CWE-829` to detect Unpinned Actions. The queries are part of the https://github.com/advanced-security/codeql-queries/ repo. |
| 17 | + |
| 18 | +In our exercise we have included a workflow file called `unpinned-action.yml` that has this vulnerability and our goal is to detect this vulnerability using the advanced security queries developed by the GitHub field team. |
| 19 | + |
| 20 | +## Create a code scanning config file. |
| 21 | +A custom configuration file is an alternative way to specify additional packs and queries to run. You can also use the file to disable the default queries, exclude or include specific queries, and to specify which directories to scan during analysis. See [Using a custom configuration file](https://docs.github.com/en/code-security/code-scanning/creating-an-advanced-setup-for-code-scanning/customizing-your-advanced-setup-for-code-scanning#using-a-custom-configuration-file) |
| 22 | + |
| 23 | +In this workshop we will customize to: |
| 24 | +- Add one addtional pack `advanced-security/codeql-javascript` |
| 25 | +- Add a path filter to only look at the workflows |
| 26 | +- Add a query filter to only use the Actions specific queries. |
| 27 | +_**NOTE:**_ The last two customizations are to improve the performance by reducing the codebase and using a narrow set of queries. |
| 28 | + |
| 29 | + |
| 30 | +Create a config file in the root of the repository with the following name `codeql-config.yml`. Add the following contents in the file: |
| 31 | +``` |
| 32 | +packs: |
| 33 | + # Use the latest version of 'codeql-javascript' published by 'advanced-security' |
| 34 | + - advanced-security/codeql-javascript |
| 35 | +query-filters: |
| 36 | + - include: |
| 37 | + tags contain: actions |
| 38 | +paths: |
| 39 | + - '.github/workflows' |
| 40 | +``` |
| 41 | + |
| 42 | +## Update the workflow. |
| 43 | +In the workflow file, use the config-file parameter of the init action to specify the path to the configuration file you want to use. In our exercise we load the configuration file `./codeql-config.yml`. The modified workflow file should look like this (comments have been removed for readability): |
| 44 | + |
| 45 | +``` |
| 46 | +name: "Actions Workflow CodeQL" |
| 47 | +
|
| 48 | +on: |
| 49 | + push: |
| 50 | + branches: [ "develop" ] |
| 51 | + workflow_dispatch: |
| 52 | +
|
| 53 | +jobs: |
| 54 | + analyze: |
| 55 | + name: Analyze |
| 56 | + runs-on: 'ubuntu-latest' |
| 57 | + timeout-minutes: 360 |
| 58 | + permissions: |
| 59 | + actions: read |
| 60 | + contents: read |
| 61 | + security-events: write |
| 62 | +
|
| 63 | + strategy: |
| 64 | + fail-fast: false |
| 65 | + matrix: |
| 66 | + language: [ 'javascript' ] |
| 67 | +
|
| 68 | + steps: |
| 69 | + - name: Checkout repository |
| 70 | + uses: actions/checkout@v3 |
| 71 | +
|
| 72 | + # Initializes the CodeQL tools for scanning. |
| 73 | + - name: Initialize CodeQL |
| 74 | + uses: github/codeql-action/init@v2 |
| 75 | + with: |
| 76 | + languages: ${{ matrix.language }} |
| 77 | + config-file: './codeql-config.yml' |
| 78 | + - name: Perform CodeQL Analysis |
| 79 | + uses: github/codeql-action/analyze@v2 |
| 80 | + with: |
| 81 | + category: "/language:${{matrix.language}}" |
| 82 | +``` |
| 83 | + |
| 84 | +When the file is committed, the `Actions WorkFlow CodeQL` workflow should be triggered. Once this is completed, check the `security` tab to see the alerts for the new vulnerability. |
| 85 | + |
0 commit comments