From 4a16de2bc8abd0bef4ea6169d95b70f655001808 Mon Sep 17 00:00:00 2001 From: Owen Mansel-Chan Date: Wed, 3 Dec 2025 12:59:35 +0000 Subject: [PATCH] Pull out logic into separate predicate --- .../actions/security/CodeInjectionQuery.qll | 22 ++++++++++--------- 1 file changed, 12 insertions(+), 10 deletions(-) diff --git a/actions/ql/lib/codeql/actions/security/CodeInjectionQuery.qll b/actions/ql/lib/codeql/actions/security/CodeInjectionQuery.qll index bdea8e81962..3d5b8852b85 100644 --- a/actions/ql/lib/codeql/actions/security/CodeInjectionQuery.qll +++ b/actions/ql/lib/codeql/actions/security/CodeInjectionQuery.qll @@ -19,12 +19,7 @@ class CodeInjectionSink extends DataFlow::Node { Event getRelevantCriticalEventForSink(DataFlow::Node sink) { inPrivilegedContext(sink.asExpr(), result) and not exists(ControlCheck check | check.protects(sink.asExpr(), result, "code-injection")) and - // exclude cases where the sink is a JS script and the expression uses toJson - not exists(UsesStep script | - script.getCallee() = "actions/github-script" and - script.getArgumentExpr("script") = sink.asExpr() and - exists(getAToJsonReferenceExpression(sink.asExpr().(Expression).getExpression(), _)) - ) + not isGithubScriptUsingToJson(sink.asExpr()) } /** @@ -112,10 +107,17 @@ predicate mediumSeverityCodeInjection( ) { CodeInjectionFlow::flowPath(source, sink) and not criticalSeverityCodeInjection(source, sink, _) and - // exclude cases where the sink is a JS script and the expression uses toJson - not exists(UsesStep script | + not isGithubScriptUsingToJson(sink.getNode().asExpr()) +} + +/** + * Holds if `expr` is the `script` input to `actions/github-script` and it uses + * `toJson`. + */ +predicate isGithubScriptUsingToJson(Expression expr) { + exists(UsesStep script | script.getCallee() = "actions/github-script" and - script.getArgumentExpr("script") = sink.getNode().asExpr() and - exists(getAToJsonReferenceExpression(sink.getNode().asExpr().(Expression).getExpression(), _)) + script.getArgumentExpr("script") = expr and + exists(getAToJsonReferenceExpression(expr.getExpression(), _)) ) }