Actions/RequestForgeryQuery

d10c · d10c · commit 8d6c9bcf40b6 · 2025-10-08T13:22:57.000+02:00
actions/ql/src/experimental/Security/CWE-918/RequestForgery.ql uses source as endpoint
diff --git a/actions/ql/lib/codeql/actions/security/RequestForgeryQuery.qll b/actions/ql/lib/codeql/actions/security/RequestForgeryQuery.qll
@@ -18,8 +18,6 @@ private module RequestForgeryConfig implements DataFlow::ConfigSig {
   predicate isSink(DataFlow::Node sink) { sink instanceof RequestForgerySink }
 
   predicate observeDiffInformedIncrementalMode() { any() }
-
-  Location getASelectedSourceLocation(DataFlow::Node sink) { none() }
 }
 
 /** Tracks flow of unsafe user input that is used to construct and evaluate a system command. */

Original file line number	Diff line number	Diff line change
`@@ -18,8 +18,6 @@ private module RequestForgeryConfig implements DataFlow::ConfigSig {`
`18`	`18`	`predicate isSink(DataFlow::Node sink) { sink instanceof RequestForgerySink }`
`19`	`19`
`20`	`20`	`predicate observeDiffInformedIncrementalMode() { any() }`
`21`		`-`
`22`		`- Location getASelectedSourceLocation(DataFlow::Node sink) { none() }`
`23`	`21`	`}`
`24`	`22`
`25`	`23`	`/** Tracks flow of unsafe user input that is used to construct and evaluate a system command. */`