Merge remote-tracking branch 'github/main' into fix/actions-output-clobbering-regex

# Conflicts:
#	actions/ql/test/query-tests/Security/CWE-074/OutputClobberingHigh.expected

Author: JarLob

actions/ql/lib/codeql/actions/security/EnvVarInjectionQuery.qll

@@ -151,7 +151,7 @@ Event getRelevantNonArtifactEventInPrivilegedContext(DataFlow::Node sink) {
 private module EnvVarInjectionConfig implements DataFlow::ConfigSig {
   predicate isSource(DataFlow::Node source) {
     source instanceof RemoteFlowSource and
-    not source.(RemoteFlowSource).getSourceType() = ["branch", "username"]
+    not source.(RemoteFlowSource).getSourceType() = ["branch", "label", "username"]
   }
 
   predicate isSink(DataFlow::Node sink) { sink instanceof EnvVarInjectionSink }

actions/ql/lib/codeql/actions/security/UntrustedCheckoutQuery.qll

@@ -382,3 +382,50 @@ class GhSHACheckout extends SHACheckoutStep instanceof Run {
 
   override string getPath() { result = this.(Run).getWorkingDirectory() }
 }
+
+private predicate isRunCheckoutReference(
+  PRHeadCheckoutStep checkout, Expression reference, string variable
+) {
+  reference = checkout.(Run).getInScopeEnvVarExpr(variable) and
+  (
+    checkout instanceof SHACheckoutStep and containsHeadSHA(reference.getExpression())
+    or
+    checkout instanceof MutableRefCheckoutStep and
+    (
+      containsHeadRef(reference.getExpression()) or
+      containsPullRequestNumber(reference.getExpression())
+    )
+  ) and
+  exists(string command |
+    checkout.(Run).getScript().getACommand() = command and
+    exists(command.regexpFind(variable, _, _))
+  )
+}
+
+/** Gets the expression that controls the untrusted checkout, if one can be identified. */
+AstNode getCheckoutReference(PRHeadCheckoutStep checkout) {
+  exists(UsesStep uses | uses = checkout |
+    result = uses.getArgumentExpr("ref")
+    or
+    not exists(uses.getArgumentExpr("ref")) and result = uses.getArgumentExpr("repository")
+  )
+  or
+  isRunCheckoutReference(checkout, result, _)
+  or
+  checkout instanceof Run and
+  result = checkout and
+  not isRunCheckoutReference(checkout, _, _)
+}
+
+/** Gets a display label for the expression that controls the untrusted checkout. */
+string getCheckoutReferenceText(AstNode reference) {
+  result = reference.(Expression).toString()
+  or
+  not reference instanceof Expression and result = "the checkout command"
+}
+
+/** Adds checkout-reference provenance before the checkout step in path queries. */
+predicate checkoutReferenceEdge(AstNode predecessor, AstNode successor) {
+  predecessor = getCheckoutReference(successor) and
+  not predecessor = successor
+}

actions/ql/src/Security/CWE-077/EnvVarInjectionCritical.ql

@@ -19,9 +19,16 @@ import codeql.actions.dataflow.FlowSources
 import EnvVarInjectionFlow::PathGraph
 import codeql.actions.security.ControlChecks
 
+bindingset[source, event]
+pragma[inline_late]
+private predicate hasSameEventName(RemoteFlowSource source, Event event) {
+  source.getEventName() = event.getName()
+}
+
 from EnvVarInjectionFlow::PathNode source, EnvVarInjectionFlow::PathNode sink, Event event
 where
   EnvVarInjectionFlow::flowPath(source, sink) and
+  hasSameEventName(source.getNode(), event) and
   // exclude paths to file read sinks from non-artifact sources
   (
     // source is text

actions/ql/src/Security/CWE-349/CachePoisoningViaPoisonableStep.ql

@@ -18,20 +18,30 @@ import codeql.actions.security.CachePoisoningQuery
 import codeql.actions.security.PoisonableSteps
 import codeql.actions.security.ControlChecks
 
-query predicate edges(Step a, Step b) { a.getNextStep() = b }
+query predicate edges(AstNode predecessor, AstNode successor) {
+  predecessor.(Step).getNextStep() = successor
+  or
+  checkoutReferenceEdge(predecessor, successor)
+}
 
-from LocalJob job, Event event, Step source, Step step, string message, string path
+from
+  LocalJob job, Event event, Step source, Step step, string message, string path,
+  AstNode untrustedInput, string untrustedInputText
 where
   // the job checkouts untrusted code from a pull request or downloads an untrusted artifact
   job.getAStep() = source and
   (
     source instanceof PRHeadCheckoutStep and
-    message = "due to privilege checkout of untrusted code." and
-    path = source.(PRHeadCheckoutStep).getPath()
+    message = "due to privilege checkout of untrusted code from" and
+    path = source.(PRHeadCheckoutStep).getPath() and
+    untrustedInput = getCheckoutReference(source) and
+    untrustedInputText = getCheckoutReferenceText(untrustedInput)
     or
     source instanceof UntrustedArtifactDownloadStep and
-    message = "due to downloading an untrusted artifact." and
-    path = source.(UntrustedArtifactDownloadStep).getPath()
+    message = "due to downloading" and
+    path = source.(UntrustedArtifactDownloadStep).getPath() and
+    untrustedInput = source and
+    untrustedInputText = "an untrusted artifact"
   ) and
   // the checkout/download is not controlled by an access check
   not exists(ControlCheck check |
@@ -57,6 +67,6 @@ where
   step instanceof PoisonableStep and
   // excluding privileged workflows since they can be exploited in easier circumstances
   not job.isPrivileged()
-select step, source, step,
-  "Potential cache poisoning in the context of the default branch " + message + " ($@).", event,
-  event.getName()
+select step, untrustedInput, step,
+  "Potential cache poisoning in the context of the default branch " + message + " $@. ($@).",
+  untrustedInput, untrustedInputText, event, event.getName()

actions/ql/src/Security/CWE-829/UntrustedCheckoutCritical.ql

@@ -18,10 +18,18 @@ import codeql.actions.security.UntrustedCheckoutQuery
 import codeql.actions.security.PoisonableSteps
 import codeql.actions.security.ControlChecks
 
-query predicate edges(Step a, Step b) { a.getNextStep() = b }
+query predicate edges(AstNode predecessor, AstNode successor) {
+  predecessor.(Step).getNextStep() = successor
+  or
+  checkoutReferenceEdge(predecessor, successor)
+}
 
-from PRHeadCheckoutStep checkout, PoisonableStep poisonable, Event event
+from
+  PRHeadCheckoutStep checkout, PoisonableStep poisonable, Event event, AstNode checkoutReference,
+  string checkoutReferenceText
 where
+  checkoutReference = getCheckoutReference(checkout) and
+  checkoutReferenceText = getCheckoutReferenceText(checkoutReference) and
   // the checkout is followed by a known poisonable step
   checkout.getAFollowingStep() = poisonable and
   (
@@ -51,6 +59,6 @@ where
   event.getName() = checkoutTriggers() and
   not exists(ControlCheck check | check.protects(checkout, event, "untrusted-checkout")) and
   not exists(ControlCheck check | check.protects(poisonable, event, "untrusted-checkout"))
-select checkout, checkout, poisonable,
-  "Checkout of untrusted code in a privileged workflow with later potential execution (event trigger: $@).",
-  event, event.getName()
+select checkout, checkoutReference, poisonable,
+  "Checkout of untrusted code from $@ in a privileged workflow with later potential execution (event trigger: $@).",
+  checkoutReference, checkoutReferenceText, event, event.getName()

actions/ql/src/change-notes/2026-07-18-envvar-injection-precision.md

@@ -0,0 +1,4 @@
+---
+category: minorAnalysis
+---
+* The `actions/envvar-injection/critical` query now requires the untrusted source and privileged context to originate from the same trigger event. The environment variable injection queries also no longer treat pull request head labels as injection-capable because they cannot contain newlines.

actions/ql/src/change-notes/2026-07-28-checkout-provenance.md

@@ -0,0 +1,4 @@
+---
+category: fix
+---
+* The `actions/cache-poisoning/poisonable-step` and `actions/untrusted-checkout/critical` queries now start paths at the expressions that control untrusted checkouts and link their alert messages to those expressions.

actions/ql/src/change-notes/2026-07-29-output-clobbering-messages.md

@@ -0,0 +1,4 @@
+---
+category: fix
+---
+* The `actions/output-clobbering/high` query now provides messages tailored to the affected output channel and includes expanded documentation and recommendations.

actions/ql/src/experimental/Security/CWE-074/OutputClobberingHigh.md

@@ -0,0 +1,88 @@
+## Overview
+
+GitHub Actions steps communicate output values to the runner through a line-oriented command format. A step normally sets an output by appending a `name=value` record to the file referenced by `GITHUB_OUTPUT`. Multiline values use a delimiter-based form. Older workflows may instead emit `set-output` workflow commands to standard output.
+
+If attacker-controlled data is written to one of these command channels without validation, the data may be interpreted as command syntax rather than as a single value. An attacker can use newline characters, a matching multiline delimiter, or a forged workflow command to create additional outputs or overwrite output values that later steps expect to be trusted.
+
+The attacker-controlled data may come directly from an event, or indirectly from an untrusted checkout, downloaded artifact, file, or action output. Clobbered outputs can alter conditions and arguments in later steps. If a later step interpolates an injected output into a script, this issue may contribute to arbitrary code execution.
+
+## Recommendation
+
+Treat values from events, pull requests, artifacts, untrusted files, and third-party actions as untrusted.
+
+Before writing an untrusted value to `GITHUB_OUTPUT`, validate it against the narrow format required by the workflow. For example, require a pull request number to contain only decimal digits. For a single-line output, reject carriage-return and newline characters. Do not append an untrusted file directly to `GITHUB_OUTPUT`.
+
+Do not use the deprecated `set-output` workflow command. Migrate to `GITHUB_OUTPUT`, and avoid printing untrusted data while legacy workflow-command processing is enabled.
+
+For multiline values, use a random delimiter that cannot occur on a line by itself in the value. If the value is arbitrary, store it in a normal file instead of using the multiline command format, and pass only the validated file path as an output.
+
+Review the documentation and implementation of actions that consume untrusted inputs. Use only inputs that the action handles as data rather than as output-command syntax.
+
+## Example
+
+### Incorrect Usage
+
+The following step reads an attacker-controlled artifact file and writes its contents directly to `GITHUB_OUTPUT`. A newline in `pr-number.txt` can add another output record and overwrite `approved`.
+
+```yaml
+- id: metadata
+  run: |
+    echo "approved=false" >> "$GITHUB_OUTPUT"
+    echo "pr_number=$(cat pr-number.txt)" >> "$GITHUB_OUTPUT"
+```
+
+For example, an attacker can provide a `pr-number.txt` artifact with the following contents:
+
+```text
+123
+approved=true
+```
+
+The step appends the following records to `GITHUB_OUTPUT`:
+
+```text
+approved=false
+pr_number=123
+approved=true
+```
+
+The injected record replaces the expected `approved` output with the attacker-controlled value
+`true`.
+
+Likewise, printing untrusted data to standard output can forge a legacy workflow command:
+
+```yaml
+- id: metadata
+  env:
+    BODY: ${{ github.event.comment.body }}
+  run: |
+    echo "$BODY"
+    echo "::set-output name=approved::false"
+```
+
+### Correct Usage
+
+Validate the value before writing it to `GITHUB_OUTPUT`, and use a fixed output name with a single-line value:
+
+```yaml
+- id: metadata
+  run: |
+    pr_number="$(cat pr-number.txt)"
+    if [[ ! "$pr_number" =~ ^[0-9]+$ ]]; then
+      echo "Invalid pull request number" >&2
+      exit 1
+    fi
+    printf 'pr_number=%s\n' "$pr_number" >> "$GITHUB_OUTPUT"
+```
+
+## References
+
+- GitHub Docs: [Workflow commands for GitHub Actions](https://docs.github.com/en/actions/reference/workflows-and-actions/workflow-commands).
+- GitHub Docs: [Setting an output parameter](https://docs.github.com/en/actions/reference/workflows-and-actions/workflow-commands#setting-an-output-parameter).
+- GitHub Docs: [Multiline strings](https://docs.github.com/en/actions/reference/workflows-and-actions/workflow-commands#multiline-strings).
+- GitHub Changelog: [Deprecating `save-state` and `set-output` commands](https://github.blog/changelog/2022-10-10-github-actions-deprecating-save-state-and-set-output-commands/).
+- GitHub Actions Toolkit: [`add-path` and `set-env` runner commands are processed via stdout](https://github.com/actions/toolkit/security/advisories/GHSA-mfwh-5m23-j46w).
+- GitHub Security Lab: [New vulnerability patterns and mitigation strategies](https://securitylab.github.com/resources/github-actions-new-patterns-and-mitigations/).
+- GitHub Security Lab: [Actions expression injection in Ant Design](https://securitylab.github.com/advisories/GHSL-2024-121_GHSL-2024-122_ant-design/).
+- GitHub Security Lab: [Poisoned Pipeline Execution via code injection in SymPy](https://securitylab.github.com/advisories/GHSL-2024-322_Sympy/).
+- Common Weakness Enumeration: [CWE-74](https://cwe.mitre.org/data/definitions/74.html).

actions/ql/src/experimental/Security/CWE-074/OutputClobberingHigh.ql

@@ -19,6 +19,42 @@ import codeql.actions.dataflow.FlowSources
 import OutputClobberingFlow::PathGraph
 import codeql.actions.security.ControlChecks
 
+private predicate isEnvironmentFileSink(OutputClobberingFlow::PathNode sink) {
+  sink.getNode() instanceof OutputClobberingFromFileReadSink or
+  sink.getNode() instanceof OutputClobberingFromEnvVarSink
+}
+
+private predicate isWorkflowCommandSink(OutputClobberingFlow::PathNode sink) {
+  sink.getNode() instanceof WorkflowCommandClobberingFromFileReadSink or
+  sink.getNode() instanceof WorkflowCommandClobberingFromEnvVarSink
+}
+
+private string getMessage(OutputClobberingFlow::PathNode sink) {
+  isEnvironmentFileSink(sink) and
+  result =
+    "Attacker-controlled data may inject or overwrite step outputs written through " +
+      "`$GITHUB_OUTPUT` in $@."
+  or
+  not isEnvironmentFileSink(sink) and
+  isWorkflowCommandSink(sink) and
+  result =
+    "Attacker-controlled data printed to standard output may forge a `set-output` " +
+      "workflow command and overwrite step outputs in $@."
+  or
+  not isEnvironmentFileSink(sink) and
+  not isWorkflowCommandSink(sink) and
+  result = "Attacker-controlled data may inject or overwrite step outputs in $@."
+}
+
+private string getSinkLabel(OutputClobberingFlow::PathNode sink) {
+  (isEnvironmentFileSink(sink) or isWorkflowCommandSink(sink)) and
+  result = "this step"
+  or
+  not isEnvironmentFileSink(sink) and
+  not isWorkflowCommandSink(sink) and
+  result = "this action"
+}
+
 from OutputClobberingFlow::PathNode source, OutputClobberingFlow::PathNode sink, Event event
 where
   OutputClobberingFlow::flowPath(source, sink) and
@@ -40,5 +76,4 @@ where
       madSink(sink.getNode(), "output-clobbering")
     )
   )
-select sink.getNode(), source, sink, "Potential clobbering of a step output in $@.", sink,
-  sink.getNode().toString()
+select sink.getNode(), source, sink, getMessage(sink), sink, getSinkLabel(sink)