Merge pull request #89 from github/change_sources

Add new sources for github.event.changes

Author: Alvaro Muñoz

ql/lib/ext/config/context_event_map.yml

@@ -4,34 +4,47 @@ extensions:
       extensible: contextTriggerDataModel 
     data:
       - ["commit_comment", "github.event.comment"] 
+      - ["commit_comment", "github.event.changes"] 
       - ["discussion", "github.event.discussion"]
+      - ["discussion", "github.event.changes"] 
       - ["discussion_comment", "github.event.comment"] 
       - ["discussion_comment", "github.event.discussion"]
+      - ["discussion_comment", "github.event.changes"] 
       - ["issues", "github.event.issue"] 
+      - ["issues", "github.event.changes"] 
       - ["issue_comment", "github.event.issue"] 
       - ["issue_comment", "github.event.comment"] 
+      - ["issue_comment", "github.event.changes"] 
       - ["gollum", "github.event.pages"] 
+      - ["gollum", "github.event.changes"] 
       - ["merge_group", "github.event.merge_group"] 
       - ["pull_request", "github.event.pull_request"] 
       - ["pull_request", "github.head_ref"] 
+      - ["pull_request", "github.event.changes"] 
       - ["pull_request_comment", "github.event.comment"] 
       - ["pull_request_comment", "github.event.pull_request"] 
       - ["pull_request_comment", "github.head_ref"] 
+      - ["pull_request_comment", "github.event.changes"] 
       - ["pull_request_review", "github.event.pull_request"] 
       - ["pull_request_review", "github.event.review"] 
       - ["pull_request_review", "github.head_ref"] 
+      - ["pull_request_review", "github.event.changes"] 
       - ["pull_request_review_comment", "github.event.comment"] 
       - ["pull_request_review_comment", "github.event.pull_request"] 
       - ["pull_request_review_comment", "github.event.review"] 
       - ["pull_request_review_comment", "github.head_ref"] 
+      - ["pull_request_review_comment", "github.event.changes"] 
       - ["pull_request_target", "github.event.pull_request"] 
       - ["pull_request_target", "github.head_ref"] 
+      - ["pull_request_target", "github.event.changes"] 
       - ["push", "github.event.commits"]
       - ["push", "github.event.head_commit"]
+      - ["push", "github.event.changes"] 
       - ["repository_dispatch", "github.event.client_payload"]
       - ["workflow_dispatch", "github.event.inputs"]
       - ["workflow_run", "github.event.workflow"]
       - ["workflow_run", "github.event.workflow_run"]
+      - ["workflow_run", "github.event.changes"] 
       # workflow_call receives the same event payload as the calling workflow
       - ["workflow_call", "github.event.client_payload"]
       - ["workflow_call", "github.event.comment"] 
@@ -46,4 +59,5 @@ extensions:
       - ["workflow_call", "github.event.review"] 
       - ["workflow_call", "github.event.workflow"]
       - ["workflow_call", "github.event.workflow_run"]
+      - ["workflow_call", "github.event.changes"] 
 

ql/lib/ext/config/untrusted_event_properties.yml

@@ -10,6 +10,7 @@ extensions:
       - ["github\\.event\\.pages\\[[0-9]+\\]\\.page_name", "title"]
       - ["github\\.event\\.pages\\[[0-9]+\\]\\.title", "title"]
       - ["github\\.event\\.workflow_run\\.display_title", "title"]
+      - ["github\\.event\\.changes\\.title\\.from", "title"]
       # URL
       - ["github\\.event\\.pull_request\\.head\\.repo\\.homepage", "url"]
       # TEXT
@@ -25,12 +26,14 @@ extensions:
       - ["github\\.event\\.workflow_run\\.head_repository\\.description", "text"]
       - ["github\\.event\\.client_payload\\[[0-9]+\\]", "text"]
       - ["github\\.event\\.client_payload", "text"]
+      - ["github\\.event\\.changes\\.body\\.from", "title"]
       # BRANCH
       - ["github\\.event\\.pull_request\\.head\\.repo\\.default_branch", "branch"]
       - ["github\\.event\\.pull_request\\.head\\.ref", "branch"]
       - ["github\\.event\\.workflow_run\\.head_branch", "branch"]
       - ["github\\.event\\.workflow_run\\.pull_requests\\[[0-9]+\\]\\.head\\.ref", "branch"]
       - ["github\\.event\\.merge_group\\.head_ref", "branch"]
+      - ["github\\.event\\.changes\\.head\\.ref\\.from", "branch"]
       # LABEL
       - ["github\\.event\\.pull_request\\.head\\.label", "label"]
       # EMAIL
@@ -79,5 +82,6 @@ extensions:
       - ["github\\.event\\.workflow_run\\.head_commit\\.committer", "json"]
       - ["github\\.event\\.workflow_run\\.head_repository", "json"]
       - ["github\\.event\\.workflow_run\\.pull_requests", "json"]
+      - ["github\\.event\\.changes", "json"]
 
 

ql/test/query-tests/Security/CWE-094/.github/workflows/test13.yml

@@ -0,0 +1,14 @@
+name: Pull Request Open
+
+on:
+  pull_request_target:
+
+jobs:
+  test:
+    runs-on: ubuntu-latest
+    steps:
+      - run: echo "${{ github.event.changes.body.from }}"
+      - run: echo "${{ github.event.changes.title.from }}"
+      - run: echo "${{ github.event.changes.head.ref.from }}"
+      - run: echo "${{ toJson(github.event.changes) }}"
+