Skip to content

Commit c509296

Browse files
fengjixuchuifengjixuchui
authored
Merge pull request #4 from github/main
Merge pull request #744 from github/xcorail-patch-4
2 parents ca22183 + 2c4ff61 commit c509296

165 files changed

Lines changed: 24357 additions & 7256 deletions

File tree

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

‎.eslintignore‎

Lines changed: 0 additions & 2 deletions
This file was deleted.

‎.github/ISSUE_TEMPLATE/all-for-one.md‎

Lines changed: 0 additions & 26 deletions
This file was deleted.

‎.github/ISSUE_TEMPLATE/all-for-one.yml‎

Lines changed: 91 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,91 @@
1+
name: All for One, One For All bounty submission
2+
description: Submit a CodeQL query for the All For One, One For All bounty (https://securitylab.github.com/bounties#allforone)
3+
title: "[<language>]: <short description>"
4+
labels: [All For One]
5+
body:
6+
- type: markdown
7+
attributes:
8+
value: |
9+
# Introduction
10+
11+
Thank you for submitting a query to the GitHub CodeQL project!
12+
13+
After you submit this issue, the GitHub Security Lab and CodeQL teams will triage the submission and, if it meets the Query Bounty Program requirements, we will grant you a bounty through our HackerOne program.
14+
15+
Please make sure to carefully read the [bounty program description and conditions](https://securitylab.github.com/bounties#allforone)
16+
17+
# Questionnaire
18+
- type: input
19+
id: pr_url
20+
attributes:
21+
label: Query PR
22+
description: Link to pull request with your CodeQL query
23+
placeholder: |
24+
ex. https://github.com/github/codeql/pull/nnnn
25+
validations:
26+
required: true
27+
- type: dropdown
28+
id: language
29+
attributes:
30+
label: Language
31+
description: What programming language is your query written for?
32+
options:
33+
- Java
34+
- Javascript
35+
- GoLang
36+
- Python
37+
- Ruby
38+
- C/C++
39+
- C#
40+
validations:
41+
required: true
42+
- type: textarea
43+
id: cve_ids
44+
attributes:
45+
label: CVE(s) ID list
46+
description: Enter a list of the CVE ID(s) associated with this query, one bullet for each distinct CVE. GitHub will automatically link CVE IDs to the [GitHub Advisory Database](https://github.com/advisories). If the result(s) is **NOT YET** fixed **nor disclosed**, and you are still waiting for a CVE, then you can privately share your result via email to [security@github.com](mailto:security@github.com?subject=[BugBounty]%20Issue%20#000%20useful%20result)
47+
placeholder: |
48+
ex.
49+
- [CVE-20nn-xxxx](<relevant URL>)
50+
- [CVE-20nn-yyyy](<relevant URL>)
51+
validations:
52+
required: true
53+
- type: input
54+
id: cwe
55+
attributes:
56+
label: CWE
57+
description: "[CWE](https://cwe.mitre.org/data/index.html) that best fits the vulnerability class modeled with your query"
58+
placeholder: |
59+
ex. CWE-502: Deserialization of Untrusted Data
60+
validations:
61+
required: false
62+
- type: textarea
63+
id: report
64+
attributes:
65+
label: Report
66+
description: Describe the vulnerability. Provide any information you think will help GitHub assess the impact your query has on the open source community.
67+
placeholder: |
68+
1. What is the vulnerability?
69+
2. How does the vulnerability work?
70+
3. What strategy do you use in your query to find the vulnerability?
71+
4. How have you reduced the number of **false positives**?
72+
5. Other information?
73+
validations:
74+
required: true
75+
- type: checkboxes
76+
id: social
77+
attributes:
78+
label: Are you planning to discuss this vulnerability submission publicly? (Blog Post, social networks, etc).
79+
description: We would love to have you spread the word about the good work you are doing
80+
options:
81+
- label: "Yes"
82+
- label: "No"
83+
validations:
84+
required: true
85+
- type: input
86+
id: social_url
87+
attributes:
88+
label: Blog post link
89+
description: If you have already blogged about your query, please provide a link.
90+
validations:
91+
required: false

‎.github/ISSUE_TEMPLATE/bug-slayer.md‎

Lines changed: 0 additions & 20 deletions
This file was deleted.

‎.github/ISSUE_TEMPLATE/bug-slayer.yml‎

Lines changed: 66 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,66 @@
1+
name: The Bug Slayer bounty submission
2+
description: Submit a CodeQL query for the Bug Slayer bounty (https://securitylab.github.com/bounties)
3+
title: "[<language>]: <short description>"
4+
labels: [The Bug Slayer]
5+
body:
6+
- type: markdown
7+
attributes:
8+
value: |
9+
# Introduction
10+
11+
Thank you for your submission to the bounty program!
12+
13+
After you submit this issue, the GitHub Security Lab and CodeQL teams will triage the submission and, if it meets the Query Bounty Program requirements, we will grant you a bounty through our HackerOne program.
14+
15+
Please make sure to carefully read the [bounty program description and conditions](https://securitylab.github.com/bounties/)
16+
17+
# Questionnaire
18+
- type: textarea
19+
id: cve_ids
20+
attributes:
21+
label: CVE(s) ID list
22+
description: Enter a list of the CVE ID(s) associated with this query, one bullet for each distinct CVE. You need at least four high severity CVEs or two critical severity CVEs.
23+
placeholder: |
24+
ex.
25+
- [CVE-20nn-xxxx](<relevant URL>)
26+
- [CVE-20nn-yyyy](<relevant URL>)
27+
validations:
28+
required: true
29+
- type: input
30+
id: a41_url
31+
attributes:
32+
label: All For One submission
33+
description: Link to the All For One submission with your CodeQL query
34+
placeholder: |
35+
ex. https://github.com/github/securitylab/issues/nnn
36+
validations:
37+
required: true
38+
- type: textarea
39+
id: details
40+
attributes:
41+
label: Details
42+
description: Detail here how you found each CVE with your query. You can provide LGTM results, links to codeql DBs, ... anything that demonstrates that your query finds each CVE.
43+
placeholder: |
44+
ex.
45+
- link/to/my/lgtm/runs
46+
- link/to/gist/with/modified/query
47+
- link/to/codeql/db
48+
validations:
49+
required: true
50+
- type: checkboxes
51+
id: social
52+
attributes:
53+
label: Are you planning to discuss this vulnerability submission publicly? (Blog Post, social networks, etc).
54+
description: We would love to have you spread the word about the good work you are doing
55+
options:
56+
- label: "Yes"
57+
- label: "No"
58+
validations:
59+
required: true
60+
- type: input
61+
id: social_url
62+
attributes:
63+
label: Blog post link
64+
description: If you have already blogged about your query, please provide a link.
65+
validations:
66+
required: false

‎.github/ISSUE_TEMPLATE/wall-of-fame.yml‎

Lines changed: 59 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,59 @@
1+
name: CodeQL Wall of Fame submission
2+
description: Propose an entry to the CodeQL Wall of Fame (https://securitylab.github.com/codeql-wall-of-fame)
3+
title: "[wall-of-fame]: <short description>"
4+
labels: [wall-of-fame]
5+
body:
6+
- type: markdown
7+
attributes:
8+
value: |
9+
# Welcome!
10+
11+
Thank you for submitting an entry for the CodeQL Wall of Fame!
12+
13+
# Details
14+
- type: input
15+
id: date
16+
attributes:
17+
label: Date
18+
description: Publication date of the blog post, in YYYY-MM-DD format
19+
placeholder: |
20+
ex. 2023-01-01
21+
validations:
22+
required: true
23+
- type: input
24+
id: title
25+
attributes:
26+
label: Title
27+
description: Title of the blog post
28+
validations:
29+
required: true
30+
- type: input
31+
id: author
32+
attributes:
33+
label: Author
34+
description: Author of the blog post
35+
validations:
36+
required: true
37+
- type: input
38+
id: url
39+
attributes:
40+
label: URL
41+
description: URL of the blog post
42+
validations:
43+
required: true
44+
- type: input
45+
id: cve
46+
attributes:
47+
label: CVE
48+
description: CVE ID(s), comma separated
49+
placeholder: |
50+
ex. CVE-2023-0001, CVE-2023-0002
51+
validations:
52+
required: true
53+
- type: textarea
54+
id: description
55+
attributes:
56+
label: Description
57+
description: Short summary of the blog post
58+
validations:
59+
required: true

‎.github/actions/check/action.yml‎

Lines changed: 0 additions & 10 deletions
This file was deleted.

‎.github/actions/check/check-replication.js‎

Lines changed: 0 additions & 57 deletions
This file was deleted.

‎.github/actions/check/check-replication.ts‎

Lines changed: 0 additions & 37 deletions
This file was deleted.

0 commit comments

Comments
 (0)