Mathew Payne GeekMasher

## PrintStatement.ql
/**
 * @name Using Print Statement in Production Code
 * @description Using Print Statement in Production Code
 * @kind problem
 * @problem.severity recommendation
 * @id py/print-statement
 * @precision very-high
 * @tags correctness
 */

## licensing.py
import os
import csv
import argparse
# pip install ghastoolkit
from ghastoolkit import GitHub, DependencyGraph

parser = argparse.ArgumentParser("licensing")
parser.add_argument(
    "-r", "--repository",
    default=os.environ.get("GITHUB_REPOSITORY"),

## Q1_FindSource.ql
/**
 * @name SQL Injection - Find Source
 * @description SQL Injection - Find Source
 * @kind problem
 * @id py/workshop
 * @problem.severity error
 * @security-severity 10.0
 * @sub-severity high
 * @precision high
 * @tags security

## unauth.ql
/**
 * @name test
 * @kind problem
 * @id js/unauthorized
 * @tags security
 */

import javascript

// https://github.com/cisagov/RedEye

## install.sh
#!/bin/bash
# Install one-liner:
# ```
# curl -o install.sh https://gist.githubusercontent.com/GeekMasher/29999096c764675bcb6cc89c65e687b5/raw/install.sh && chmod +x install.sh && bash -c ./install.sh
# ```
# References:
#  - https://docs.nvidia.com/cuda/cuda-installation-guide-linux/index.html#ubuntu-installation

distro=$(cat /etc/os-release | grep -m 1 NAME | cut -d \" -f2)
version=$(cat /etc/os-release | grep -m 1 VERSION_ID | cut -d \" -f2 | sed 's/\.//g')

## codeql-config.yml
name: "Custom CodeQL Configuration"

# Disabling the default queries is critical part of this.
# Nothing will be disabled if the default queries still run.
# - https://docs.github.com/en/code-security/secure-coding/configuring-code-scanning#disabling-the-default-queries
disable-default-queries: true

queries:
  # Point to the custom query suite that needs to be used
  - uses: ./.github/codeql/custom-javascript.qls

## update-public-sshkeys.sh
USERNAME=$1

mkdir -p ~/.ssh

if ! [[ -f ~/.ssh/authorized_keys ]]; then
  echo "Creating new ~/.ssh/authorized_keys"
  touch ~/.ssh/authorized_keys
fi

keys=`curl https://api.github.com/users/$USERNAME/keys | grep -o -E "ssh-\w+\s+[^\"]+"`

## test.jsp
<HTML>
     <HEAD>
           <TITLE>Hello World</TITLE>
    </HEAD>
    <BODY>
        <H1>Hello World</H1>
        Today is: <%= new java.util.Date().toString() %>
    </BODY>
</HTML>
	/**
	* @name Using Print Statement in Production Code
	* @description Using Print Statement in Production Code
	* @kind problem
	* @problem.severity recommendation
	* @id py/print-statement
	* @precision very-high
	* @tags correctness
	*/
	import os
	import csv
	import argparse
	# pip install ghastoolkit
	from ghastoolkit import GitHub, DependencyGraph

	parser = argparse.ArgumentParser("licensing")
	parser.add_argument(
	"-r", "--repository",
	default=os.environ.get("GITHUB_REPOSITORY"),
	/**
	* @name SQL Injection - Find Source
	* @description SQL Injection - Find Source
	* @kind problem
	* @id py/workshop
	* @problem.severity error
	* @security-severity 10.0
	* @sub-severity high
	* @precision high
	* @tags security
	/**
	* @name test
	* @kind problem
	* @id js/unauthorized
	* @tags security
	*/

	import javascript

	// https://github.com/cisagov/RedEye
	#!/bin/bash
	# Install one-liner:
	# ```
	# curl -o install.sh https://gist.githubusercontent.com/GeekMasher/29999096c764675bcb6cc89c65e687b5/raw/install.sh && chmod +x install.sh && bash -c ./install.sh
	# ```
	# References:
	# - https://docs.nvidia.com/cuda/cuda-installation-guide-linux/index.html#ubuntu-installation

	distro=$(cat /etc/os-release \| grep -m 1 NAME \| cut -d \" -f2)
	version=$(cat /etc/os-release \| grep -m 1 VERSION_ID \| cut -d \" -f2 \| sed 's/\.//g')
	name: "Custom CodeQL Configuration"

	# Disabling the default queries is critical part of this.
	# Nothing will be disabled if the default queries still run.
	# - https://docs.github.com/en/code-security/secure-coding/configuring-code-scanning#disabling-the-default-queries
	disable-default-queries: true

	queries:
	# Point to the custom query suite that needs to be used
	- uses: ./.github/codeql/custom-javascript.qls
	USERNAME=$1

	mkdir -p ~/.ssh

	if ! [[ -f ~/.ssh/authorized_keys ]]; then
	echo "Creating new ~/.ssh/authorized_keys"
	touch ~/.ssh/authorized_keys
	fi

	keys=`curl https://api.github.com/users/$USERNAME/keys \| grep -o -E "ssh-\w+\s+[^\"]+"`
	<HTML>
	<HEAD>
	<TITLE>Hello World</TITLE>
	</HEAD>
	<BODY>
	<H1>Hello World</H1>
	Today is: <%= new java.util.Date().toString() %>
	</BODY>
	</HTML>