hohn/codeql
1
0
Fork 0
mirror of https://github.com/github/codeql.git synced 2026-04-11 18:14:01 +02:00
Code Issues Packages Projects Releases Wiki Activity

Adjust alert messages CWE-829/ArtifactPoisoning[Critical|Medium]

Browse Source
This commit is contained in:
Kristen Newbury
2026-04-02 11:32:37 -04:00
parent cedacc91db
commit e69e30aa84
3 changed files with 7 additions and 4 deletions
Download Patch File Download Diff File Expand all files Collapse all files

4
actions/ql/src/Security/CWE-829/ArtifactPoisoningCritical.ql
View File

@@ -21,5 +21,5 @@ where
ArtifactPoisoningFlow::flowPath(source, sink) and
event = getRelevantEventInPrivilegedContext(sink.getNode())
select sink.getNode(), source, sink,
"Potential artifact poisoning in $@, which may be controlled by an external user ($@).", sink,
sink.getNode().toString(), event, event.getName()
"Potential artifact poisoning, which may be controlled by an external user ($@).", event,
event.getName()

3
actions/ql/src/Security/CWE-829/ArtifactPoisoningMedium.ql
View File

@@ -21,5 +21,4 @@ where
ArtifactPoisoningFlow::flowPath(source, sink) and
inNonPrivilegedContext(sink.getNode().asExpr())
select sink.getNode(), source, sink,
"Potential artifact poisoning in $@, which may be controlled by an external user.", sink,
sink.getNode().toString()
"Potential artifact poisoning, which may be controlled by an external user."

4
actions/ql/src/change-notes/2026-04-02-alert-msg-poisoning.md Normal file
View File

@@ -0,0 +1,4 @@
---
category: majorAnalysis
---
* Fixed alert messages in `actions/artifact-poisoning/critical` and `actions/artifact-poisoning/medium` as they previously included a redundant placeholder in the alert message that would on occasion contain a long block of yml that makes the alert difficult to understand.