open-quantum-safe / liboqs / 40565087428

79%

Build Type

push

github

Committed by web-flow

Commit Message

Add CodeQL query to enforce OpenSSL return code handling (#1867) (#2634)

* ci: add CodeQL query to enforce OpenSSL return code handling

Adds a custom CodeQL query (.github/codeql/openssl-return-check.ql)
that detects calls to OpenSSL EVP_* functions whose return value is
not guarded by the OQS_OPENSSL_GUARD macro. Integrates the query into
a new CodeQL workflow (.github/workflows/codeql.yml) that runs on
every PR and push to main.

The query was originally written by Trail of Bits during their audit
of liboqs and reported in issue #1867.

Closes #1867
Signed-off-by: Vishnu Ajith <27vishnu07@gmail.com>

* ci: move security-events permission to job level in CodeQL workflow

Addresses Scorecard Token-Permissions finding: security-events write
permission scoped to codeql job only, not workflow level.
Signed-off-by: Vishnu Ajith <27vishnu07@gmail.com>

* ci: fix CodeQL query path using config file

Replace inline queries: path with a codeql-config.yml config file.
The CodeQL init action requires local queries to be referenced via
a config file rather than a direct relative path in the queries field.
Signed-off-by: Vishnu Ajith <27vishnu07@gmail.com>

* ci: disable CodeQL TRAP caching to fix pre-finalize crash

The CodeQL cpp extractor pre-finalize script crashes with exit code 134
when the trapCaches/cpp/tarballs directory does not exist on the runner.
Disabling TRAP caching avoids the crash.
Signed-off-by: Vishnu Ajith <27vishnu07@gmail.com>

* ci: use inline queries field per maintainer suggestion

Replace config-file approach with inline queries field combining
security-and-quality suite with the custom EVP return check query,
as suggested by @baentsch. Remove codeql-config.yml.
Signed-off-by: Vishnu Ajith <27vishnu07@gmail.com>

* ci: re-add TRAP caching workaround after queries field change

Signed-off-by: Vishnu Ajith <27vishnu07@gmail.com>

* ci: disable SARIF upload to avoid default setup conflict

Adding upload: false to the analyze step prevent... (continued)

Coverage Stats

1 of 3 new or added lines in 1 file covered. (33.33%)

23 existing lines in 18 files now uncovered.

186412 of 230058 relevant lines covered (81.03%)

4081959.71 hits per line