codeql

CodeQL このオープンソースリポジトリには、GitHub Advanced Security と、GitHub が世界中の顧客に提供しているその他のアプリケーションセキュリティ製品を支える、標準の CodeQL ライブラリとクエリが含まれています。 CodeQL の学習とクエリの実行方法 CodeQL 言語 に関する広範なドキュメント、Visual Studio Code 用 CodeQL 拡張機能 を使用した CodeQL の作成方法、および CodeQL CLI の使用方法についてのドキュメントが用意されています。 貢献...

witcher

witcher Implement and monitor Appsec control at scale. Requirements NodeJS 20.13 Tested on Mac Ubuntu How to install root@kitploit: $ git clone [email protected]:mf-labs/witcher.git $ cd witcher $ npm i Build a Docker image root@kitploit: $ git clone [email protected]:mf-labs/witcher.gi...

GitHub Advanced Security to CSV 安全漏洞

GitHub Advanced Security to CSV is a library by Natalie Somersall, an individual developer in the US. It is a simple GitHub operation for grabbing the GitHub Advanced Security API and pushing it to CSV. A security vulnerability exists in versions prior to GitHub Advanced Security to CSV V1 that...

CVE-2022-39217 Improper Neutralization of Formula Elements in a CSV File in ghas-to-csv

some-natalie/ghas-to-csv GitHub Advanced Security to CSV is a GitHub action which scrapes the GitHub Advanced Security API and shoves it into a CSV. In affected versions this GitHub Action creates a CSV file without sanitizing the output of the APIs. If an alert is dismissed or any other custom...

CVE-2022-39217 Improper Neutralization of Formula Elements in a CSV File in ghas-to-csv

some-natalie/ghas-to-csv GitHub Advanced Security to CSV is a GitHub action which scrapes the GitHub Advanced Security API and shoves it into a CSV. In affected versions this GitHub Action creates a CSV file without sanitizing the output of the APIs. If an alert is dismissed or any other custom...