Merge branch 'main' into main

Author: adrienpessu

actions/ql/lib/change-notes/2026-07-27-merge-group-event-source.md

@@ -0,0 +1,4 @@
+---
+category: minorAnalysis
+---
+* GitHub Actions analysis now recognizes untrusted data in `github.event.merge_group` for workflows triggered by the `merge_group` event.

actions/ql/lib/codeql/actions/security/EnvVarInjectionQuery.qll

@@ -151,7 +151,7 @@ Event getRelevantNonArtifactEventInPrivilegedContext(DataFlow::Node sink) {
 private module EnvVarInjectionConfig implements DataFlow::ConfigSig {
   predicate isSource(DataFlow::Node source) {
     source instanceof RemoteFlowSource and
-    not source.(RemoteFlowSource).getSourceType() = ["branch", "username"]
+    not source.(RemoteFlowSource).getSourceType() = ["branch", "label", "username"]
   }
 
   predicate isSink(DataFlow::Node sink) { sink instanceof EnvVarInjectionSink }

actions/ql/lib/codeql/actions/security/OutputClobberingQuery.qll

@@ -111,6 +111,43 @@ class WorkflowCommandClobberingFromEnvVarSink extends OutputClobberingSink {
   }
 }
 
+private string jqSafeOptionRegexp() {
+  result = "-[acCMeRnSs]+"
+  or
+  result =
+    "--(ascii-output|color-output|compact-output|exit-status|monochrome-output|null-input|" +
+      "raw-input|slurp|sort-keys|unbuffered)"
+}
+
+private string jqSimpleFilterRegexp() {
+  result = "\\."
+  or
+  result = "\\.[A-Za-z_][A-Za-z0-9_]*(\\.[A-Za-z_][A-Za-z0-9_]*|\\[[0-9]+\\])*"
+}
+
+private string jqSimpleFilterArgumentRegexp() {
+  result = jqSimpleFilterRegexp()
+  or
+  result = "'" + jqSimpleFilterRegexp() + "'"
+  or
+  result = "\"" + jqSimpleFilterRegexp() + "\""
+}
+
+private string jqLiteralInputRegexp() {
+  result = "[A-Za-z0-9_./][A-Za-z0-9_./-]*"
+  or
+  result = "\\$GITHUB_EVENT_PATH"
+  or
+  result = "\\$\\{GITHUB_EVENT_PATH\\}"
+}
+
+bindingset[command]
+private predicate jqProducesJsonEncodedOutput(string command) {
+  command
+      .regexpMatch("jq(\\s+" + jqSafeOptionRegexp() + ")*\\s+" + jqSimpleFilterArgumentRegexp() +
+          "(\\s+" + jqSafeOptionRegexp() + ")*(\\s+" + jqLiteralInputRegexp() + ")*")
+}
+
 /**
  *      - id: clob1
  *        run: |
@@ -159,13 +196,17 @@ class WorkflowCommandClobberingFromFileReadSink extends OutputClobberingSink {
         clobbering_cmd.regexpMatch(["ls", Bash::fileReadCommand()] + "\\s.*") and
         (
           // - run: echo "foo=$(<pr-id.txt)"
-          clobbering_stmt.regexpMatch("echo.*" + clobbering_cmd + ".*")
+          exists(string echo, int echoOffset |
+            echo = clobbering_stmt.regexpFind("\\becho\\s+", _, echoOffset) and
+            clobbering_stmt.indexOf(clobbering_cmd, 0, echoOffset + echo.length()) >= 0
+          )
           or
           // A file content is printed to stdout
           // - run: cat pr-id.txt
           clobbering_stmt.indexOf(clobbering_cmd) = 0
         )
-      )
+      ) and
+      not jqProducesJsonEncodedOutput(clobbering_cmd)
     )
   }
 }

actions/ql/lib/codeql/actions/security/UntrustedCheckoutQuery.qll

@@ -382,3 +382,50 @@ class GhSHACheckout extends SHACheckoutStep instanceof Run {
 
   override string getPath() { result = this.(Run).getWorkingDirectory() }
 }
+
+private predicate isRunCheckoutReference(
+  PRHeadCheckoutStep checkout, Expression reference, string variable
+) {
+  reference = checkout.(Run).getInScopeEnvVarExpr(variable) and
+  (
+    checkout instanceof SHACheckoutStep and containsHeadSHA(reference.getExpression())
+    or
+    checkout instanceof MutableRefCheckoutStep and
+    (
+      containsHeadRef(reference.getExpression()) or
+      containsPullRequestNumber(reference.getExpression())
+    )
+  ) and
+  exists(string command |
+    checkout.(Run).getScript().getACommand() = command and
+    exists(command.regexpFind(variable, _, _))
+  )
+}
+
+/** Gets the expression that controls the untrusted checkout, if one can be identified. */
+AstNode getCheckoutReference(PRHeadCheckoutStep checkout) {
+  exists(UsesStep uses | uses = checkout |
+    result = uses.getArgumentExpr("ref")
+    or
+    not exists(uses.getArgumentExpr("ref")) and result = uses.getArgumentExpr("repository")
+  )
+  or
+  isRunCheckoutReference(checkout, result, _)
+  or
+  checkout instanceof Run and
+  result = checkout and
+  not isRunCheckoutReference(checkout, _, _)
+}
+
+/** Gets a display label for the expression that controls the untrusted checkout. */
+string getCheckoutReferenceText(AstNode reference) {
+  result = reference.(Expression).toString()
+  or
+  not reference instanceof Expression and result = "the checkout command"
+}
+
+/** Adds checkout-reference provenance before the checkout step in path queries. */
+predicate checkoutReferenceEdge(AstNode predecessor, AstNode successor) {
+  predecessor = getCheckoutReference(successor) and
+  not predecessor = successor
+}

actions/ql/lib/ext/config/context_event_map.yml

@@ -19,6 +19,7 @@ extensions:
       - ["gollum", "github.event.changes"] 
       - ["pull_request_comment", "github.event.comment"] 
       - ["pull_request_comment", "github.event.pull_request"] 
+      - ["merge_group", "github.event.merge_group"]
       - ["pull_request_comment", "github.head_ref"] 
       - ["pull_request_comment", "github.event.changes"] 
       - ["pull_request_review", "github.event.pull_request"] 

actions/ql/lib/ext/config/externally_triggereable_events.yml

@@ -17,4 +17,4 @@ extensions:
       - ["workflow_run"] # depending on branch filter
       - ["workflow_call"] # depending on caller
       - ["workflow_dispatch"] 
-      - ["scheduled"]
+      - ["schedule"]

actions/ql/src/Security/CWE-077/EnvVarInjectionCritical.ql

@@ -19,9 +19,16 @@ import codeql.actions.dataflow.FlowSources
 import EnvVarInjectionFlow::PathGraph
 import codeql.actions.security.ControlChecks
 
+bindingset[source, event]
+pragma[inline_late]
+private predicate hasSameEventName(RemoteFlowSource source, Event event) {
+  source.getEventName() = event.getName()
+}
+
 from EnvVarInjectionFlow::PathNode source, EnvVarInjectionFlow::PathNode sink, Event event
 where
   EnvVarInjectionFlow::flowPath(source, sink) and
+  hasSameEventName(source.getNode(), event) and
   // exclude paths to file read sinks from non-artifact sources
   (
     // source is text

actions/ql/src/Security/CWE-349/CachePoisoningViaPoisonableStep.ql

@@ -18,20 +18,30 @@ import codeql.actions.security.CachePoisoningQuery
 import codeql.actions.security.PoisonableSteps
 import codeql.actions.security.ControlChecks
 
-query predicate edges(Step a, Step b) { a.getNextStep() = b }
+query predicate edges(AstNode predecessor, AstNode successor) {
+  predecessor.(Step).getNextStep() = successor
+  or
+  checkoutReferenceEdge(predecessor, successor)
+}
 
-from LocalJob job, Event event, Step source, Step step, string message, string path
+from
+  LocalJob job, Event event, Step source, Step step, string message, string path,
+  AstNode untrustedInput, string untrustedInputText
 where
   // the job checkouts untrusted code from a pull request or downloads an untrusted artifact
   job.getAStep() = source and
   (
     source instanceof PRHeadCheckoutStep and
-    message = "due to privilege checkout of untrusted code." and
-    path = source.(PRHeadCheckoutStep).getPath()
+    message = "due to privilege checkout of untrusted code from" and
+    path = source.(PRHeadCheckoutStep).getPath() and
+    untrustedInput = getCheckoutReference(source) and
+    untrustedInputText = getCheckoutReferenceText(untrustedInput)
     or
     source instanceof UntrustedArtifactDownloadStep and
-    message = "due to downloading an untrusted artifact." and
-    path = source.(UntrustedArtifactDownloadStep).getPath()
+    message = "due to downloading" and
+    path = source.(UntrustedArtifactDownloadStep).getPath() and
+    untrustedInput = source and
+    untrustedInputText = "an untrusted artifact"
   ) and
   // the checkout/download is not controlled by an access check
   not exists(ControlCheck check |
@@ -57,6 +67,6 @@ where
   step instanceof PoisonableStep and
   // excluding privileged workflows since they can be exploited in easier circumstances
   not job.isPrivileged()
-select step, source, step,
-  "Potential cache poisoning in the context of the default branch " + message + " ($@).", event,
-  event.getName()
+select step, untrustedInput, step,
+  "Potential cache poisoning in the context of the default branch " + message + " $@. ($@).",
+  untrustedInput, untrustedInputText, event, event.getName()

actions/ql/src/Security/CWE-829/UntrustedCheckoutCritical.ql

@@ -18,10 +18,18 @@ import codeql.actions.security.UntrustedCheckoutQuery
 import codeql.actions.security.PoisonableSteps
 import codeql.actions.security.ControlChecks
 
-query predicate edges(Step a, Step b) { a.getNextStep() = b }
+query predicate edges(AstNode predecessor, AstNode successor) {
+  predecessor.(Step).getNextStep() = successor
+  or
+  checkoutReferenceEdge(predecessor, successor)
+}
 
-from PRHeadCheckoutStep checkout, PoisonableStep poisonable, Event event
+from
+  PRHeadCheckoutStep checkout, PoisonableStep poisonable, Event event, AstNode checkoutReference,
+  string checkoutReferenceText
 where
+  checkoutReference = getCheckoutReference(checkout) and
+  checkoutReferenceText = getCheckoutReferenceText(checkoutReference) and
   // the checkout is followed by a known poisonable step
   checkout.getAFollowingStep() = poisonable and
   (
@@ -51,6 +59,6 @@ where
   event.getName() = checkoutTriggers() and
   not exists(ControlCheck check | check.protects(checkout, event, "untrusted-checkout")) and
   not exists(ControlCheck check | check.protects(poisonable, event, "untrusted-checkout"))
-select checkout, checkout, poisonable,
-  "Checkout of untrusted code in a privileged workflow with later potential execution (event trigger: $@).",
-  event, event.getName()
+select checkout, checkoutReference, poisonable,
+  "Checkout of untrusted code from $@ in a privileged workflow with later potential execution (event trigger: $@).",
+  checkoutReference, checkoutReferenceText, event, event.getName()

actions/ql/src/change-notes/2026-07-18-envvar-injection-precision.md

@@ -0,0 +1,4 @@
+---
+category: minorAnalysis
+---
+* The `actions/envvar-injection/critical` query now requires the untrusted source and privileged context to originate from the same trigger event. The environment variable injection queries also no longer treat pull request head labels as injection-capable because they cannot contain newlines.