GitHub Sharpens CodeQL’s Eye on Actions Workflows and Modern JavaScript

Sicherheitsmeldung mit Schweregrad noch nicht bewertet. Technische Details im Tab „Originaltext“; empfohlene Schritte in der Checkliste.

Originaltext der Quelle (nicht übersetzt) – die deutsche Zusammenfassung findest du im Tab „Kurzfassung".

GitHub Actions pipelines have become one of the quieter attack surfaces in software development. They pull in third-party actions, cache dependencies, and pass secrets between jobs, often without anyone reviewing the workflow file as closely as they’d review application code. That gap is exactly where cache-poisoning and output-clobbering attacks live, and it’s why GitHub keeps tuning CodeQL’s ability to spot them. CodeQL 2.26.3, released August 12 and detailed in GitHub’s changelog on August 19, focuses squarely on that problem. The update refines several GitHub Actions security queries and expands JavaScript and TypeScript modeling, with a particular focus on Vue applications. The release keeps CodeQL’s default security suite at 497 queries covering 170 CWE categories, with an extended suite adding another 131 queries across 32 more CWEs. That scope matters less than the accuracy of individual queries, though, which is where most of this release’s effort went. The Actions-focused changes are practical rather than flashy. The output-clobbering query now delivers messages tailored to the specific output channel it flags, and it no longer flags simple jq path filters when their output remains JSON-encoded, which should reduce noisy false positives. GitHub also fixed a performance issue in that query caused by unescaped source-code input in a regular expression. Cache-poisoning and untrusted-checkout queries got a workflow improvement of their own: alert paths now start at the expressions that control untrusted checkouts, so the alert message links directly to the code …

Vollständiger Originalartikel ↗

• Betroffenheit im eigenen Stack prüfen: Versionen/Komponenten abgleichen.
• Originalquelle / Hersteller-Advisory lesen: https://devops.com/github-sharpens-codeqls-eye-on-actions-workflows-and-modern-javascript/
• Verfügbaren Patch oder Workaround einspielen und dokumentieren.