Merge branch 'main' into unifiedcommandinjection

Author: geoffw0

.github/workflows/csv-coverage-pr-artifacts.yml

@@ -47,10 +47,10 @@ jobs:
           git checkout HEAD^1
           git log -1 --format='%H'
         working-directory: base
-      - name: Set up Python 3.8
+      - name: Set up Python 3.12
         uses: actions/setup-python@v4
         with:
-          python-version: 3.8
+          python-version: "3.12"
       - name: Download CodeQL CLI
         uses: ./merge/.github/actions/fetch-codeql
       - name: Generate CSV files on merge commit of the PR

.github/workflows/csv-coverage-pr-comment.yml

@@ -25,10 +25,10 @@ jobs:
       run: echo "$GITHUB_CONTEXT"
     - name: Clone self (github/codeql)
       uses: actions/checkout@v5
-    - name: Set up Python 3.8
+    - name: Set up Python 3.12
       uses: actions/setup-python@v4
       with:
-        python-version: 3.8
+        python-version: "3.12"
 
     - name: Check coverage difference file and comment
       env:

.github/workflows/csv-coverage-timeseries.yml

@@ -20,10 +20,10 @@ jobs:
         with:
           path: codeqlModels
           fetch-depth: 0
-      - name: Set up Python 3.8
+      - name: Set up Python 3.12
         uses: actions/setup-python@v4
         with:
-          python-version: 3.8
+          python-version: "3.12"
       - name: Download CodeQL CLI
         uses: ./script/.github/actions/fetch-codeql
       - name: Build modeled package list

.github/workflows/csv-coverage-update.yml

@@ -25,10 +25,10 @@ jobs:
         with:
           path: ql
           fetch-depth: 0
-      - name: Set up Python 3.8
+      - name: Set up Python 3.12
         uses: actions/setup-python@v4
         with:
-          python-version: 3.8
+          python-version: "3.12"
       - name: Download CodeQL CLI
         uses: ./ql/.github/actions/fetch-codeql
       - name: Generate coverage files

.github/workflows/csv-coverage.yml

@@ -24,10 +24,10 @@ jobs:
         with:
           path: codeqlModels
           ref: ${{ github.event.inputs.qlModelShaOverride || github.ref }}
-      - name: Set up Python 3.8
+      - name: Set up Python 3.12
         uses: actions/setup-python@v4
         with:
-          python-version: 3.8
+          python-version: "3.12"
       - name: Download CodeQL CLI
         uses: ./script/.github/actions/fetch-codeql
       - name: Build modeled package list

.github/workflows/query-list.yml

@@ -26,10 +26,10 @@ jobs:
       uses: actions/checkout@v5
       with:
         path: codeql 
-    - name: Set up Python 3.8
+    - name: Set up Python 3.12
       uses: actions/setup-python@v4
       with:
-        python-version: 3.8
+        python-version: "3.12"
     - name: Download CodeQL CLI
       # Look under the `codeql` directory, as this is where we checked out the `github/codeql` repo
       uses: ./codeql/.github/actions/fetch-codeql

cpp/ql/src/Security/CWE/CWE-078/ExecTainted.qhelp

@@ -34,7 +34,7 @@ should be safe against command injection.</p>
 Sanitize data passed to complex subsystems</a>.</li>
 <li>
 OWASP:
-<a href="https://www.owasp.org/index.php/Command_Injection">Command Injection</a>.
+<a href="https://community.owasp.org/attacks/Command_Injection">Command Injection</a>.
 </li>
 
 

cpp/ql/src/experimental/Security/CWE/CWE-078/WordexpTainted.qhelp

@@ -31,7 +31,7 @@ is performed, making this safe from command injection.</p>
 Sanitize data passed to complex subsystems</a>.</li>
 <li>
 OWASP:
-<a href="https://www.owasp.org/index.php/Command_Injection">Command Injection</a>.
+<a href="https://community.owasp.org/attacks/Command_Injection">Command Injection</a>.
 </li>
 
 

csharp/ql/src/Security Features/CWE-078/CommandInjection.qhelp

@@ -33,7 +33,7 @@ without examining it first.</p>
 
 <li>
 OWASP:
-<a href="https://www.owasp.org/index.php/Command_Injection">Command Injection</a>.
+<a href="https://community.owasp.org/attacks/Command_Injection">Command Injection</a>.
 </li>
 
 <!--  LocalWords:  CWE untrusted unsanitized Runtime

go/extractor/registries/registryproxy.go

@@ -103,7 +103,13 @@ func getEnvVars() []string {
 			slog.Error("Failed to close the temporary certificate file", slog.String("error", err.Error()))
 		} else {
 			proxy_cert_file = f.Name()
-			result = append(result, fmt.Sprintf("SSL_CERT_FILE=%s", proxy_cert_file))
+			// `SSL_CERT_FILE` is used by Go itself; `GIT_SSL_CAINFO` is used by the `git`
+			// processes that `go` spawns to fetch `git_source` modules.
+			result = append(
+				result,
+				fmt.Sprintf("SSL_CERT_FILE=%s", proxy_cert_file),
+				fmt.Sprintf("GIT_SSL_CAINFO=%s", proxy_cert_file),
+			)
 		}
 	}
 
@@ -160,18 +166,6 @@ func getEnvVars() []string {
 
 			if len(git_sources) > 0 {
 				goprivate = append(goprivate, git_sources...)
-
-				if proxy_cert_file != "" {
-					slog.Info("Configuring `git` to use proxy certificate", slog.String("path", proxy_cert_file))
-					cmd := exec.Command("git", "config", "--global", "http.sslCAInfo", proxy_cert_file)
-
-					out, cmdErr := cmd.CombinedOutput()
-					slog.Info(string(out))
-
-					if cmdErr != nil {
-						slog.Error("Failed to configure `git` to accept the certificate file", slog.String("error", cmdErr.Error()))
-					}
-				}
 			}
 
 			result = append(result, fmt.Sprintf("GOPRIVATE=%s", strings.Join(goprivate, ",")))