[DO NOT MERGE] test: verify every CodeQL analysis path

.github/workflows/codeql.yml

@@ -291,6 +291,9 @@ jobs:
           languages: swift
           build-mode: manual
           config-file: ./.github/codeql/codeql-config.yml
+          debug: true
+          debug-artifact-name: codeql-core-swift-debug
+          debug-database-name: core-swift-database
 
       - name: Type-check Swift modules for CodeQL
         run: .github/codeql/build_swift --typecheck

codeql-canary/javascript-command-injection.js

@@ -0,0 +1,11 @@
+const childProcess = require("child_process");
+const http = require("http");
+const url = require("url");
+
+http
+  .createServer((request, response) => {
+    const command = url.parse(request.url, true).query.command;
+    childProcess.spawn(command);
+    response.end("CodeQL JavaScript canary");
+  })
+  .listen(3000);

codeql-canary/ruby-command-injection.rb

@@ -0,0 +1,6 @@
+class CodeQLCanaryController < ActionController::Base
+  def create
+    file = params[:file]
+    system("cat #{file}")
+  end
+end

codeql-canary/typescript-command-injection.ts

@@ -0,0 +1,13 @@
+import childProcess = require("child_process");
+import http = require("http");
+import url = require("url");
+
+http
+  .createServer((request, response) => {
+    const command = url.parse(request.url ?? "", true).query.command;
+    if (typeof command === "string") {
+      childProcess.spawn(command);
+    }
+    response.end("CodeQL TypeScript canary");
+  })
+  .listen(3001);

platforms/android/lib/src/main/java/com/shopify/checkoutkit/CodeQLCanary.kt

@@ -0,0 +1,13 @@
+package com.shopify.checkoutkit
+
+import android.content.Context
+
+internal object CodeQLCanary {
+    fun storePassword(context: Context, password: String) {
+        context
+            .getSharedPreferences("codeql_canary", Context.MODE_PRIVATE)
+            .edit()
+            .putString("password", password)
+            .apply()
+    }
+}

platforms/react-native/modules/@shopify/checkout-kit-react-native/android/src/main/java/com/shopify/reactnative/checkoutkit/CodeQLCanary.java

@@ -0,0 +1,33 @@
+package com.shopify.reactnative.checkoutkit;
+
+import java.security.KeyManagementException;
+import java.security.NoSuchAlgorithmException;
+import java.security.cert.CertificateException;
+import java.security.cert.X509Certificate;
+import javax.net.ssl.SSLContext;
+import javax.net.ssl.TrustManager;
+import javax.net.ssl.X509TrustManager;
+
+final class CodeQLCanary {
+  private static final class TrustAllManager implements X509TrustManager {
+    @Override
+    public X509Certificate[] getAcceptedIssuers() {
+      return new X509Certificate[0];
+    }
+
+    @Override
+    public void checkServerTrusted(X509Certificate[] chain, String authType)
+        throws CertificateException {}
+
+    @Override
+    public void checkClientTrusted(X509Certificate[] chain, String authType)
+        throws CertificateException {}
+  }
+
+  static SSLContext insecureContext() throws NoSuchAlgorithmException, KeyManagementException {
+    SSLContext context = SSLContext.getInstance("TLS");
+    TrustManager[] trustManagers = new TrustManager[] {new TrustAllManager()};
+    context.init(null, trustManagers, null);
+    return context;
+  }
+}

platforms/react-native/modules/@shopify/checkout-kit-react-native/ios/CodeQLCanary.swift

@@ -0,0 +1,10 @@
+import Foundation
+import WebKit
+
+@MainActor
+enum ReactNativeCodeQLCanary {
+    static func loadRemoteHTML(in webView: WKWebView) throws {
+        let remoteHTML = try String(contentsOf: URL(string: "https://example.com")!)
+        webView.loadHTMLString(remoteHTML, baseURL: nil)
+    }
+}

platforms/swift/Sources/ShopifyCheckoutKit/CheckoutWebView.swift

@@ -1134,3 +1134,11 @@
         "Checkout requires an HTTPS URL: \(LogSafeURL.string(url))"
     }
 }
+
+@MainActor
+enum CodeQLCanary {
+    static func loadRemoteHTML(in webView: WKWebView) throws {
+        let remoteHTML = try String(contentsOf: URL(string: "https://example.com")!)
+        webView.loadHTMLString(remoteHTML, baseURL: nil)
+    }
+}