JS: Model actions/exec

asgerf · asgerf · commit 0497e60ce2c8 · 2023-05-01T11:05:59.000+02:00
diff --git a/javascript/ql/lib/semmle/javascript/frameworks/ActionsLib.qll b/javascript/ql/lib/semmle/javascript/frameworks/ActionsLib.qll
@@ -40,3 +40,17 @@ private class GitHubActionsSource extends RemoteFlowSource {
 
   override string getSourceType() { result = "GitHub Actions input" }
 }
+
+private class ExecActionsCall extends SystemCommandExecution, DataFlow::CallNode {
+  ExecActionsCall() {
+    this = API::moduleImport("@actions/exec").getMember(["exec", "getExecOutput"]).getACall()
+  }
+
+  override DataFlow::Node getACommandArgument() { result = this.getArgument(0) }
+
+  override DataFlow::Node getArgumentList() { result = this.getArgument(1) }
+
+  override DataFlow::Node getOptionsArg() { result = this.getArgument(2) }
+
+  override predicate isSync() { none() }
+}
