fix(regex): update pattern to match both gh and hub commands

2026-04-30 19:26:02 +02:00 · 2024-07-23 23:37:04 +02:00
parent 2dffb865d0
commit 12e78ac4fe
1 changed files with 1 additions and 1 deletions
--- a/ql/lib/codeql/actions/security/UntrustedCheckoutQuery.qll
+++ b/ql/lib/codeql/actions/security/UntrustedCheckoutQuery.qll
@@ -242,7 +242,7 @@ class GhMutableRefCheckout extends MutableRefCheckoutStep instanceof Run {
  GhMutableRefCheckout() {
    exists(string line |
      this.getScript().splitAt("\n") = line and
-      line.regexpMatch(".*gh\\s+pr\\s+checkout.*") and
+      line.regexpMatch(".*(gh|hub)\\s+pr\\s+checkout.*") and
      (
        (containsHeadRef(line) or containsPullRequestNumber(line))
        or