From 2cd9220b741975a11f3db63639f456ab7933b14d Mon Sep 17 00:00:00 2001 From: Kristen Newbury Date: Fri, 10 Jul 2026 09:36:53 -0400 Subject: [PATCH] Format --- actions/ql/lib/codeql/actions/security/ControlChecks.qll | 3 ++- .../ql/src/Security/CWE-367/UntrustedCheckoutTOCTOUCritical.ql | 3 +-- 2 files changed, 3 insertions(+), 3 deletions(-) diff --git a/actions/ql/lib/codeql/actions/security/ControlChecks.qll b/actions/ql/lib/codeql/actions/security/ControlChecks.qll index 900f62556b0..ed8d6c2d050 100644 --- a/actions/ql/lib/codeql/actions/security/ControlChecks.qll +++ b/actions/ql/lib/codeql/actions/security/ControlChecks.qll @@ -144,7 +144,8 @@ class EnvironmentCheck extends ControlCheck instanceof Environment { // Environment checks are not effective against any mutable attacks // they do actually protect against untrusted code execution (sha) override predicate protectsCategoryAndEvent(string category, string event) { - event = [actor_is_attacker_event(), actor_not_attacker_event()] and category = non_toctou_category() + event = [actor_is_attacker_event(), actor_not_attacker_event()] and + category = non_toctou_category() } } diff --git a/actions/ql/src/Security/CWE-367/UntrustedCheckoutTOCTOUCritical.ql b/actions/ql/src/Security/CWE-367/UntrustedCheckoutTOCTOUCritical.ql index 14a6c9a4c56..2aacf20b35f 100644 --- a/actions/ql/src/Security/CWE-367/UntrustedCheckoutTOCTOUCritical.ql +++ b/actions/ql/src/Security/CWE-367/UntrustedCheckoutTOCTOUCritical.ql @@ -23,8 +23,7 @@ where // the checked-out code may lead to arbitrary code execution checkout.getAFollowingStep() = step and // the checkout occurs in a privileged context - inPrivilegedContext(checkout, event) - and + inPrivilegedContext(checkout, event) and // the mutable checkout step is protected by an Insufficient access check exists(ControlCheck check1 | check1.protects(checkout, event, "untrusted-checkout")) and not exists(ControlCheck check2 | check2.protects(checkout, event, "untrusted-checkout-toctou"))