-
Notifications
You must be signed in to change notification settings - Fork 8.3k
Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
Merge branch 'main' into 197612-obxuxinfra-remove-feature-flags-for-g…
…a-features
- Loading branch information
Showing
49 changed files
with
761 additions
and
3,023 deletions.
There are no files selected for viewing
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,39 @@ | ||
| FROM ubuntu:latest | ||
|
|
||
| ENV DEBIAN_FRONTEND=noninteractive | ||
|
|
||
| ARG USERNAME=codeql | ||
| ARG CODEQL_VERSION="v2.19.0" | ||
| ENV CODEQL_HOME /usr/local/codeql-home | ||
|
|
||
| RUN apt-get update && \ | ||
| apt-get install -y --no-install-recommends \ | ||
| passwd \ | ||
| adduser \ | ||
| bash \ | ||
| curl \ | ||
| git \ | ||
| unzip \ | ||
| nodejs \ | ||
| jq | ||
|
|
||
| RUN adduser --home ${CODEQL_HOME} ${USERNAME} | ||
|
|
||
| RUN curl -Lk "https://github.com/github/codeql-action/releases/download/codeql-bundle-${CODEQL_VERSION}/codeql-bundle-linux64.tar.gz" -o codeql.tar.gz \ | ||
| && mkdir -p ${CODEQL_HOME} \ | ||
| && tar -xvzf codeql.tar.gz -C ${CODEQL_HOME} \ | ||
| && rm codeql.tar.gz | ||
|
|
||
| RUN chmod +x ${CODEQL_HOME}/codeql/codeql | ||
|
|
||
| RUN chown -R ${USERNAME}:${USERNAME} ${CODEQL_HOME} | ||
|
|
||
| USER ${USERNAME} | ||
|
|
||
| ENV PATH="${CODEQL_HOME}/codeql:${PATH}" | ||
|
|
||
| RUN echo $PATH && codeql --version | ||
|
|
||
| WORKDIR /workspace | ||
|
|
||
| ENTRYPOINT ["/bin/bash", "-c"] |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,126 @@ | ||
| #!/bin/bash | ||
|
|
||
| LANGUAGE="javascript" | ||
| CODEQL_DIR=".codeql" | ||
| DATABASE_PATH="$CODEQL_DIR/database" | ||
| QUERY_OUTPUT="$DATABASE_PATH/results.sarif" | ||
| OUTPUT_FORMAT="sarif-latest" | ||
| DOCKER_IMAGE="codeql-env" | ||
| BASE_DIR="$(cd "$(dirname "$0")"; pwd)" | ||
|
|
||
| # Colors | ||
| bold=$(tput bold) | ||
| reset=$(tput sgr0) | ||
| red=$(tput setaf 1) | ||
| green=$(tput setaf 2) | ||
| blue=$(tput setaf 4) | ||
| yellow=$(tput setaf 3) | ||
|
|
||
| while getopts ":s:r:" opt; do | ||
| case $opt in | ||
| s) SRC_DIR="$OPTARG" ;; | ||
| r) CODEQL_DIR="$OPTARG"; DATABASE_PATH="$CODEQL_DIR/database"; QUERY_OUTPUT="$DATABASE_PATH/results.sarif" ;; | ||
| \?) echo "Invalid option -$OPTARG" >&2; exit 1 ;; | ||
| :) echo "Option -$OPTARG requires an argument." >&2; exit 1 ;; | ||
| esac | ||
| done | ||
|
|
||
| if [ -z "$SRC_DIR" ]; then | ||
| echo "Usage: $0 -s <source_dir> [-r <results_dir>]" | ||
| exit 1 | ||
| fi | ||
|
|
||
| mkdir -p "$CODEQL_DIR" | ||
|
|
||
| # Check the architecture | ||
| ARCH=$(uname -m) | ||
| PLATFORM_FLAG="" | ||
|
|
||
| # CodeQL CLI binary does not support arm64 architecture, setting the platform to linux/amd64 | ||
| if [[ "$ARCH" == "arm64" ]]; then | ||
| PLATFORM_FLAG="--platform linux/amd64" | ||
| fi | ||
|
|
||
| if [[ "$(docker images -q $DOCKER_IMAGE 2> /dev/null)" == "" ]]; then | ||
| echo "Docker image $DOCKER_IMAGE not found. Building locally..." | ||
| docker build $PLATFORM_FLAG -t "$DOCKER_IMAGE" -f "$BASE_DIR/codeql.dockerfile" "$BASE_DIR" | ||
| if [ $? -ne 0 ]; then | ||
| echo "${red}Docker image build failed.${reset}" | ||
| exit 1 | ||
| fi | ||
| fi | ||
|
|
||
| cleanup_database() { | ||
| echo "Deleting contents of $CODEQL_DIR." | ||
| rm -rf "$CODEQL_DIR"/* | ||
| } | ||
|
|
||
| SRC_DIR="$(cd "$(dirname "$SRC_DIR")"; pwd)/$(basename "$SRC_DIR")" | ||
| CODEQL_DIR="$(cd "$(dirname "$CODEQL_DIR")"; pwd)/$(basename "$CODEQL_DIR")" | ||
| DATABASE_PATH="$(cd "$(dirname "$DATABASE_PATH")"; pwd)/$(basename "$DATABASE_PATH")" | ||
|
|
||
| # Step 1: Run the Docker container to create a CodeQL database from the source code. | ||
| echo "Creating a CodeQL database from the source code: $SRC_DIR" | ||
| docker run $PLATFORM_FLAG --rm -v "$SRC_DIR":/workspace/source-code \ | ||
| -v "${DATABASE_PATH}":/workspace/shared $DOCKER_IMAGE \ | ||
| "codeql database create /workspace/shared/codeql-db --language=javascript --source-root=/workspace/source-code --overwrite" | ||
|
|
||
| if [ $? -ne 0 ]; then | ||
| echo "CodeQL database creation failed." | ||
| cleanup_database | ||
| exit 1 | ||
| fi | ||
|
|
||
| echo "Analyzing a CodeQL database: $DATABASE_PATH" | ||
| # Step 2: Run the Docker container to analyze the CodeQL database. | ||
| docker run $PLATFORM_FLAG --rm -v "${DATABASE_PATH}":/workspace/shared $DOCKER_IMAGE \ | ||
| "codeql database analyze --format=${OUTPUT_FORMAT} --output=/workspace/shared/results.sarif /workspace/shared/codeql-db javascript-security-and-quality.qls" | ||
|
|
||
| if [ $? -ne 0 ]; then | ||
| echo "CodeQL database analysis failed." | ||
| cleanup_database | ||
| exit 1 | ||
| fi | ||
|
|
||
| # Step 3: Print summary of SARIF results | ||
| echo "Analysis complete. Results saved to $QUERY_OUTPUT" | ||
| if command -v jq &> /dev/null; then | ||
| vulnerabilities=$(jq -r '.runs[] | select(.results | length > 0)' "$QUERY_OUTPUT") | ||
|
|
||
| if [[ -z "$vulnerabilities" ]]; then | ||
| echo "${blue}${bold}No vulnerabilities found in the SARIF results.${reset}" | ||
| else | ||
| echo "${yellow}${bold}Summary of SARIF results:${reset}" | ||
| jq -r ' | ||
| .runs[] | | ||
| .results[] as $result | | ||
| .tool.driver.rules[] as $rule | | ||
| select($rule.id == $result.ruleId) | | ||
| "Rule: \($result.ruleId)\nMessage: \($result.message.text)\nFile: \($result.locations[].physicalLocation.artifactLocation.uri)\nLine: \($result.locations[].physicalLocation.region.startLine)\nSecurity Severity: \($rule.properties."security-severity" // "N/A")\n"' "$QUERY_OUTPUT" | | ||
| while IFS= read -r line; do | ||
| case "$line" in | ||
| Rule:*) | ||
| echo "${red}${bold}$line${reset}" | ||
| ;; | ||
| Message:*) | ||
| echo "${green}$line${reset}" | ||
| ;; | ||
| File:*) | ||
| echo "${blue}$line${reset}" | ||
| ;; | ||
| Line:*) | ||
| echo "${yellow}$line${reset}" | ||
| ;; | ||
| Security\ Severity:*) | ||
| echo "${yellow}$line${reset}" | ||
| ;; | ||
| *) | ||
| echo "$line" | ||
| ;; | ||
| esac | ||
| done | ||
| fi | ||
| else | ||
| echo "${red}${bold}Please install jq to display a summary of the SARIF results.${reset}" | ||
| echo "${bold}You can view the full results in the SARIF file using a SARIF viewer.${reset}" | ||
| fi |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Oops, something went wrong.