Skip to content
Closed
Show file tree
Hide file tree
Changes from 1 commit
Commits
File filter

Filter by extension

Filter by extension

Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
57 changes: 57 additions & 0 deletions lib/tools-download.js

Some generated files are not rendered by default. Learn more about how customized files appear on GitHub.

2 changes: 1 addition & 1 deletion lib/tools-download.js.map

Some generated files are not rendered by default. Learn more about how customized files appear on GitHub.

65 changes: 65 additions & 0 deletions src/tools-download.ts
Original file line number Diff line number Diff line change
Expand Up @@ -5,6 +5,7 @@ import * as path from "path";
import { performance } from "perf_hooks";

import * as core from "@actions/core";
import * as toolrunner from "@actions/exec/lib/toolrunner";
import { HttpClient } from "@actions/http-client";
import * as toolcache from "@actions/tool-cache";
import { https } from "follow-redirects";
Expand Down Expand Up @@ -148,6 +149,13 @@ export async function downloadAndExtract(
)}).`,
);

// Add the following log to display the size of the downloaded bundle
const bundleSize = fs.statSync(archivedBundlePath).size;
logger.info(`Size of the downloaded CodeQL bundle: ${bundleSize} bytes`);

await logDiskUsage(logger);
await verifyZstdIntegrity(archivedBundlePath, logger);

let extractionDurationMs: number;

try {
Expand All @@ -167,6 +175,8 @@ export async function downloadAndExtract(
)}).`,
);
} finally {
await logDiskUsage(logger);
await verifyZstdIntegrity(archivedBundlePath, logger);
await cleanUpGlob(archivedBundlePath, "CodeQL bundle archive", logger);
}

Expand All @@ -180,6 +190,61 @@ export async function downloadAndExtract(
};
}

async function logDiskUsage(logger: Logger) {
let stdout = "";
let stderr = "";
try {
const dfRunner = new toolrunner.ToolRunner("df", ["-h"], {

Check failure

Code scanning / CodeQL

Exec call vulnerable to binary planting

This exec call might be vulnerable to Windows binary planting vulnerabilities.
silent: true,
listeners: {
stdout: (data: Buffer) => {
stdout += data.toString();
},
stderr: (data: Buffer) => {
stderr += data.toString();
},
},
});
const exitCode = await dfRunner.exec();
logger.info(`df -h exited with code ${exitCode}.`);
} catch (error) {
logger.warning(`Failed to run df: ${error}`);
}
logger.info(`df -h stdout: ${stdout}`);
logger.info(`df -h stderr: ${stderr}`);
}

async function verifyZstdIntegrity(archivedBundlePath: string, logger: Logger) {
// Run `zstd -t` on the CodeQL bundle and log the results
let stdout = "";
let stderr = "";
try {
const zstdTestRunner = new toolrunner.ToolRunner(
"zstd",
["-t", archivedBundlePath],
{
silent: true,
listeners: {
stdout: (data: Buffer) => {
stdout += data.toString();
},
stderr: (data: Buffer) => {
stderr += data.toString();
},
},
},
);
const exitCode = await zstdTestRunner.exec();
logger.info(`zstd -t exited with code ${exitCode}.`);
} catch (error) {
logger.warning(
`Failed to verify the integrity of the CodeQL bundle using zstd: ${error}`,
);
}
logger.info(`zstd -t stdout: ${stdout}`);
logger.info(`zstd -t stderr: ${stderr}`);
}

async function downloadAndExtractZstdWithStreaming(
codeqlURL: string,
dest: string,
Expand Down