From 5130135df0a87da6f23eba4b81b11383b254b19a Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Alvaro=20Mu=C3=B1oz?= <pwntester@github.com>
Date: Thu, 14 Mar 2024 16:14:55 +0100
Subject: [PATCH] fix(stepsExpression): allow steps from a composite action to
 communicate

---
 ql/lib/codeql/actions/ast/internal/Ast.qll | 9 ++++++++-
 1 file changed, 8 insertions(+), 1 deletion(-)

diff --git a/ql/lib/codeql/actions/ast/internal/Ast.qll b/ql/lib/codeql/actions/ast/internal/Ast.qll
index 5c6ce37fa92..f45565caed7 100644
--- a/ql/lib/codeql/actions/ast/internal/Ast.qll
+++ b/ql/lib/codeql/actions/ast/internal/Ast.qll
@@ -855,7 +855,14 @@ class StepsExpressionImpl extends SimpleReferenceExpressionImpl {
   override string getFieldName() { result = fieldName }
 
   override AstNodeImpl getTarget() {
-    this.getEnclosingJob() = result.getEnclosingJob() and
+    (
+      this.getEnclosingJob() = result.getEnclosingJob()
+      or
+      exists(CompositeActionImpl a |
+        a.getAChildNode*() = this and
+        a.getAChildNode*() = result
+      )
+    ) and
     result.(StepImpl).getId() = stepId
   }