Merge pull request #22266 from JarLob/improve/actions-cache-poisoning-code-injection-wording

Actions: Improve actions cache poisoning code injection wording

Author: aschackmull

actions/ql/src/Security/CWE-349/CachePoisoningViaCodeInjection.ql

@@ -1,5 +1,5 @@
 /**
- * @name Cache Poisoning via low-privileged code injection
+ * @name Cache Poisoning via code injection
  * @description The cache can be poisoned by untrusted code, leading to a cache poisoning attack.
  * @kind path-problem
  * @problem.severity error
@@ -27,5 +27,5 @@ where
     check.protects(source.getNode().asExpr(), event, "code-injection")
   )
 select sink.getNode(), source, sink,
-  "Unprivileged code injection in $@, which may lead to cache poisoning ($@).", sink,
+  "Code injection in $@ may allow poisoning the default-branch cache (event trigger: $@).", sink,
   sink.getNode().asExpr().(Expression).getRawExpression(), event, event.getName()

actions/ql/src/change-notes/2026-07-31-cache-poisoning-code-injection-wording.md

@@ -0,0 +1,4 @@
+---
+category: queryMetadata
+---
+* The name and alert message of the `actions/cache-poisoning/code-injection` query have been reworded for clarity.

actions/ql/test/query-tests/Security/CWE-349/CachePoisoningViaCodeInjection.expected

@@ -7,4 +7,4 @@ nodes
 | .github/workflows/neg_code_injection1.yml:11:17:11:48 | github.event.comment.body | semmle.label | github.event.comment.body |
 subpaths
 #select
-| .github/workflows/code_injection1.yml:11:17:11:48 | github.event.comment.body | .github/workflows/code_injection1.yml:11:17:11:48 | github.event.comment.body | .github/workflows/code_injection1.yml:11:17:11:48 | github.event.comment.body | Unprivileged code injection in $@, which may lead to cache poisoning ($@). | .github/workflows/code_injection1.yml:11:17:11:48 | github.event.comment.body | ${{ github.event.comment.body }} | .github/workflows/code_injection1.yml:2:3:2:15 | issue_comment | issue_comment |
+| .github/workflows/code_injection1.yml:11:17:11:48 | github.event.comment.body | .github/workflows/code_injection1.yml:11:17:11:48 | github.event.comment.body | .github/workflows/code_injection1.yml:11:17:11:48 | github.event.comment.body | Code injection in $@ may allow poisoning the default-branch cache (event trigger: $@). | .github/workflows/code_injection1.yml:11:17:11:48 | github.event.comment.body | ${{ github.event.comment.body }} | .github/workflows/code_injection1.yml:2:3:2:15 | issue_comment | issue_comment |