Actions: Add new query actions/code-injection/low for code injection with step outputs#20974
+484 −27
Conversation
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters. Learn more about bidirectional Unicode characters
Contributor
There was a problem hiding this comment.
Pull request overview
This PR adds a new low-precision code injection query for GitHub Actions that detects potential vulnerabilities when step outputs flow to code injection sinks. Additionally, it refactors the StepsExpression class to StepOutputExpression for better naming clarity.
- Introduces
actions/code-injection/lowquery to detect code injection via step outputs with an allowlist of known-safe actions - Renames
StepsExpressiontoStepOutputExpressionthroughout the codebase with proper deprecation - Adds comprehensive documentation and examples for the new query
Reviewed changes
Copilot reviewed 11 out of 11 changed files in this pull request and generated no comments.
Show a summary per file
| File | Description |
|---|---|
actions/ql/src/Security/CWE-094/CodeInjectionLow.ql | New query implementation for low-precision code injection detection from step outputs |
actions/ql/src/Security/CWE-094/CodeInjectionLow.md | Documentation explaining the vulnerability, recommendations, and usage examples |
actions/ql/lib/codeql/actions/security/CodeInjectionQuery.qll | Adds new data flow configuration, allowlist of safe actions, and lowSeverityCodeInjection predicate |
actions/ql/lib/codeql/actions/Ast.qll | Deprecates StepsExpression and introduces StepOutputExpression as replacement |
actions/ql/lib/codeql/actions/security/UntrustedCheckoutQuery.qll | Updates references from StepsExpression to StepOutputExpression |
actions/ql/lib/codeql/actions/dataflow/internal/DataFlowPrivate.qll | Updates references from StepsExpression to StepOutputExpression |
actions/ql/lib/codeql/actions/dataflow/TaintSteps.qll | Updates references from StepsExpression to StepOutputExpression |
actions/ql/test/query-tests/Security/CWE-094/CodeInjectionLow.qlref | Test reference file for the new query |
actions/ql/test/query-tests/Security/CWE-094/CodeInjectionLow.expected | Expected test results for the new query |
actions/ql/src/change-notes/2025-12-05-add-code-injection-low-query.md | Change note documenting the new query |
actions/ql/lib/change-notes/2025-12-05-rename-steps-expression.md | Change note documenting the deprecation of StepsExpression |
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
![github-advanced-security[bot]](https://avatars.githubusercontent.com/in/57789?s=60&v=4){kind=small}
| @@ -0,0 +1 @@ | |||
| Security/CWE-094/CodeInjectionLow.ql | |||
Check warning
Code scanning / CodeQL
Query test without inline test expectations Warning test
owen-mcforce-pushed the actions/code-injection-step-outputs-as-sources branch from 8f37f9a to 87ad7c7Compare
ContributorAuthor
owen-mc commented Dec 13, 2025
@adityasharad Are you able to review this? CI was failing but rebasing has resolved it. |
Sign up for freeto join this conversation on GitHub. Already have an account? Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
This has low precision but can catch serious issues. However, because of its low precision, it won't be included in any of our query suites. I'm not sure what to do about that.
The allowlist of actions whose outputs are not user-controlled was generated by copilot, using results from running this query on many repos using MRVA. I do not have the expertise to be sure that it is correct, so please check this. I am also interested in any other actions to add to the allowlist. Possibly we could allow users to add safe actions using data extensions, if there is demand.