robojerk/codeql-action

Add validation of remote config location, no retrieval yet

Browse source
This commit is contained in:
Sam Partington 2020-06-25 13:21:46 +01:00
parent 153a598a97
commit a19d19e0a3
6 changed files with 108 additions and 25 deletions
Download patch file Download diff file Expand all files Collapse all files

44
lib/config-utils.js generated
View file

@ -146,6 +146,12 @@ function getConfigFileDoesNotExistErrorMessage(configFile) {
return 'The configuration file "' + configFile + '" does not exist';
}
exports.getConfigFileDoesNotExistErrorMessage = getConfigFileDoesNotExistErrorMessage;
function getConfigFileRepoFormatInvalid(configFile) {
let error = 'The configuration file "' + configFile + '" is not a supported remote file reference.';
error += ' Expected format <owner>/<repository>/<file-path>@<ref>';
return error;
}
exports.getConfigFileRepoFormatInvalid = getConfigFileRepoFormatInvalid;
function getConfigFilePropertyError(configFile, property, error) {
return 'The configuration file "' + configFile + '" is invalid: property "' + property + '" ' + error;
}
@ -157,18 +163,16 @@ function initConfig() {
core.debug('No configuration file was provided');
return config;
}
// Treat the config file as relative to the workspace
const workspacePath = util.getRequiredEnvParam('GITHUB_WORKSPACE');
configFile = path.resolve(workspacePath, configFile);
// Error if the config file is now outside of the workspace
if (!(configFile + path.sep).startsWith(workspacePath + path.sep)) {
throw new Error(getConfigFileOutsideWorkspaceErrorMessage(configFile));
let parsedYAML;
if (isLocal(configFile)) {
// Treat the config file as relative to the workspace
const workspacePath = util.getRequiredEnvParam('GITHUB_WORKSPACE');
configFile = path.resolve(workspacePath, configFile);
parsedYAML = getLocalConfig(configFile, workspacePath);
}
// Error if the file does not exist
if (!fs.existsSync(configFile)) {
throw new Error(getConfigFileDoesNotExistErrorMessage(configFile));
else {
parsedYAML = getRemoteConfig(configFile);
}
const parsedYAML = yaml.safeLoad(fs.readFileSync(configFile, 'utf8'));
if (NAME_PROPERTY in parsedYAML) {
if (typeof parsedYAML[NAME_PROPERTY] !== "string") {
throw new Error(getNameInvalid(configFile));
@ -227,6 +231,26 @@ function isLocal(configPath) {
return (configPath.indexOf("@") === -1);
}
exports.isLocal = isLocal;
function getLocalConfig(configFile, workspacePath) {
// Error if the config file is now outside of the workspace
if (!(configFile + path.sep).startsWith(workspacePath + path.sep)) {
throw new Error(getConfigFileOutsideWorkspaceErrorMessage(configFile));
}
// Error if the file does not exist
if (!fs.existsSync(configFile)) {
throw new Error(getConfigFileDoesNotExistErrorMessage(configFile));
}
return yaml.safeLoad(fs.readFileSync(configFile, 'utf8'));
}
function getRemoteConfig(configFile) {
// validate the config location
const format = new RegExp('(?<owner>[^/]+)/(?<repo>[^/]+)/(?<filepath>[^@]+)@(<?ref>.*)');
const pieces = format.exec(configFile);
if (pieces === null || pieces.length < 4) {
throw new Error(getConfigFileRepoFormatInvalid(configFile));
}
return []; // temp
}
function getConfigFolder() {
return util.getRequiredEnvParam('RUNNER_TEMP');
}