From c40fe85217993a5a0c46316966c2f478ce5900f2 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Jaroslav=20Loba=C4=8Devski?= Date: Sun, 19 Jul 2026 16:54:09 +0000 Subject: [PATCH 1/2] Reworded the misleading 'Unprivileged' --- .../ql/src/Security/CWE-349/CachePoisoningViaCodeInjection.ql | 4 ++-- .../Security/CWE-349/CachePoisoningViaCodeInjection.expected | 2 +- 2 files changed, 3 insertions(+), 3 deletions(-) diff --git a/actions/ql/src/Security/CWE-349/CachePoisoningViaCodeInjection.ql b/actions/ql/src/Security/CWE-349/CachePoisoningViaCodeInjection.ql index 2fe792aba1e6..8ff02c5ee288 100644 --- a/actions/ql/src/Security/CWE-349/CachePoisoningViaCodeInjection.ql +++ b/actions/ql/src/Security/CWE-349/CachePoisoningViaCodeInjection.ql @@ -1,5 +1,5 @@ /** - * @name Cache Poisoning via low-privileged code injection + * @name Cache Poisoning via code injection * @description The cache can be poisoned by untrusted code, leading to a cache poisoning attack. * @kind path-problem * @problem.severity error @@ -27,5 +27,5 @@ where check.protects(source.getNode().asExpr(), event, "code-injection") ) select sink.getNode(), source, sink, - "Unprivileged code injection in $@, which may lead to cache poisoning ($@).", sink, + "Code injection in $@ may allow poisoning the default-branch cache (event trigger: $@).", sink, sink.getNode().asExpr().(Expression).getRawExpression(), event, event.getName() diff --git a/actions/ql/test/query-tests/Security/CWE-349/CachePoisoningViaCodeInjection.expected b/actions/ql/test/query-tests/Security/CWE-349/CachePoisoningViaCodeInjection.expected index 9cfac091f675..76a95eb204f9 100644 --- a/actions/ql/test/query-tests/Security/CWE-349/CachePoisoningViaCodeInjection.expected +++ b/actions/ql/test/query-tests/Security/CWE-349/CachePoisoningViaCodeInjection.expected @@ -7,4 +7,4 @@ nodes | .github/workflows/neg_code_injection1.yml:11:17:11:48 | github.event.comment.body | semmle.label | github.event.comment.body | subpaths #select -| .github/workflows/code_injection1.yml:11:17:11:48 | github.event.comment.body | .github/workflows/code_injection1.yml:11:17:11:48 | github.event.comment.body | .github/workflows/code_injection1.yml:11:17:11:48 | github.event.comment.body | Unprivileged code injection in $@, which may lead to cache poisoning ($@). | .github/workflows/code_injection1.yml:11:17:11:48 | github.event.comment.body | ${{ github.event.comment.body }} | .github/workflows/code_injection1.yml:2:3:2:15 | issue_comment | issue_comment | +| .github/workflows/code_injection1.yml:11:17:11:48 | github.event.comment.body | .github/workflows/code_injection1.yml:11:17:11:48 | github.event.comment.body | .github/workflows/code_injection1.yml:11:17:11:48 | github.event.comment.body | Code injection in $@ may allow poisoning the default-branch cache (event trigger: $@). | .github/workflows/code_injection1.yml:11:17:11:48 | github.event.comment.body | ${{ github.event.comment.body }} | .github/workflows/code_injection1.yml:2:3:2:15 | issue_comment | issue_comment | From caf91c9f2332eaf4bb28828eca6c013d695e74a2 Mon Sep 17 00:00:00 2001 From: JarLob Date: Fri, 31 Jul 2026 23:56:44 +0300 Subject: [PATCH 2/2] Add change note --- .../2026-07-31-cache-poisoning-code-injection-wording.md | 4 ++++ 1 file changed, 4 insertions(+) create mode 100644 actions/ql/src/change-notes/2026-07-31-cache-poisoning-code-injection-wording.md diff --git a/actions/ql/src/change-notes/2026-07-31-cache-poisoning-code-injection-wording.md b/actions/ql/src/change-notes/2026-07-31-cache-poisoning-code-injection-wording.md new file mode 100644 index 000000000000..8e2ade04f8b0 --- /dev/null +++ b/actions/ql/src/change-notes/2026-07-31-cache-poisoning-code-injection-wording.md @@ -0,0 +1,4 @@ +--- +category: queryMetadata +--- +* The name and alert message of the `actions/cache-poisoning/code-injection` query have been reworded for clarity. \ No newline at end of file