Skip to content

Actions: Add experimental prompt injection queries for CWE 1427 #21675

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Draft
data-douser wants to merge 6 commits into
base: main
Choose a base branch
from
Draft

Actions: Add experimental prompt injection queries for CWE 1427 #21675

Show file tree
Hide file tree
Changes from 1 commit
Commits
Show all changes
6 commits
Select commit Hold shift + click to select a range
11d55d8
actions: experimental queries to detect CWE-1427
data-douser Apr 8, 2026
deb402b
Merge branch 'main' into codeql-actions-scs/cwe-1427
data-douser Apr 9, 2026
9092d86
Merge branch 'main' into codeql-actions-scs/cwe-1427
mbaluda Apr 16, 2026
3f2f400
Improve PromptInjectionMedium.ql & update change-notes
data-douser Apr 9, 2026
3b5ebb6
Update missing PromptInject*.expected results
data-douser Apr 9, 2026
5b7e49e
Fixes for PR check failures
data-douser Apr 16, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
Prev Previous commit
Next Next commit
Update missing PromptInject*.expected results
  • Loading branch information
@data-douser
data-douser committed Apr 16, 2026
commit 3b5ebb66212b8ecfce4e639f18ffbf036731c227
2 changes: 2 additions & 0 deletions actions/ql/test/query-tests/Security/CWE-1427/PromptInjectionCritical.expected
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -18,6 +18,8 @@ nodes
| .github/workflows/vulnerable9.yml:17:20:17:57 | github.event.pull_request.title | semmle.label | github.event.pull_request.title |
| .github/workflows/vulnerable9.yml:18:19:18:55 | github.event.pull_request.body | semmle.label | github.event.pull_request.body |
| .github/workflows/vulnerable10.yml:16:13:16:43 | github.event.issue.title | semmle.label | github.event.issue.title |
| .github/workflows/vulnerable11.yml:18:20:18:57 | github.event.pull_request.title | semmle.label | github.event.pull_request.title |
| .github/workflows/vulnerable11.yml:19:19:19:55 | github.event.pull_request.body | semmle.label | github.event.pull_request.body |
subpaths
#select
| .github/workflows/vulnerable1.yml:19:20:19:50 | github.event.issue.title | .github/workflows/vulnerable1.yml:19:20:19:50 | github.event.issue.title | .github/workflows/vulnerable1.yml:19:20:19:50 | github.event.issue.title | Potential prompt injection in $@, which may be controlled by an external user ($@). | .github/workflows/vulnerable1.yml:19:20:19:50 | github.event.issue.title | ${{ github.event.issue.title }} | .github/workflows/vulnerable1.yml:3:3:3:8 | issues | issues |
Expand Down
4 changes: 4 additions & 0 deletions actions/ql/test/query-tests/Security/CWE-1427/PromptInjectionMedium.expected
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -18,8 +18,12 @@ nodes
| .github/workflows/vulnerable9.yml:17:20:17:57 | github.event.pull_request.title | semmle.label | github.event.pull_request.title |
| .github/workflows/vulnerable9.yml:18:19:18:55 | github.event.pull_request.body | semmle.label | github.event.pull_request.body |
| .github/workflows/vulnerable10.yml:16:13:16:43 | github.event.issue.title | semmle.label | github.event.issue.title |
| .github/workflows/vulnerable11.yml:18:20:18:57 | github.event.pull_request.title | semmle.label | github.event.pull_request.title |
| .github/workflows/vulnerable11.yml:19:19:19:55 | github.event.pull_request.body | semmle.label | github.event.pull_request.body |
subpaths
#select
| .github/workflows/vulnerable5.yml:18:13:18:50 | github.event.pull_request.title | .github/workflows/vulnerable5.yml:18:13:18:50 | github.event.pull_request.title | .github/workflows/vulnerable5.yml:18:13:18:50 | github.event.pull_request.title | Potential prompt injection in $@, which may be controlled by an external user ($@). | .github/workflows/vulnerable5.yml:18:13:18:50 | github.event.pull_request.title | ${{ github.event.pull_request.title }} | .github/workflows/vulnerable5.yml:3:3:3:14 | pull_request | pull_request |
| .github/workflows/vulnerable9.yml:17:20:17:57 | github.event.pull_request.title | .github/workflows/vulnerable9.yml:17:20:17:57 | github.event.pull_request.title | .github/workflows/vulnerable9.yml:17:20:17:57 | github.event.pull_request.title | Potential prompt injection in $@, which may be controlled by an external user ($@). | .github/workflows/vulnerable9.yml:17:20:17:57 | github.event.pull_request.title | ${{ github.event.pull_request.title }} | .github/workflows/vulnerable9.yml:3:3:3:14 | pull_request | pull_request |
| .github/workflows/vulnerable9.yml:18:19:18:55 | github.event.pull_request.body | .github/workflows/vulnerable9.yml:18:19:18:55 | github.event.pull_request.body | .github/workflows/vulnerable9.yml:18:19:18:55 | github.event.pull_request.body | Potential prompt injection in $@, which may be controlled by an external user ($@). | .github/workflows/vulnerable9.yml:18:19:18:55 | github.event.pull_request.body | ${{ github.event.pull_request.body }} | .github/workflows/vulnerable9.yml:3:3:3:14 | pull_request | pull_request |
| .github/workflows/vulnerable11.yml:18:20:18:57 | github.event.pull_request.title | .github/workflows/vulnerable11.yml:18:20:18:57 | github.event.pull_request.title | .github/workflows/vulnerable11.yml:18:20:18:57 | github.event.pull_request.title | Potential prompt injection in $@, which may be controlled by an external user ($@). | .github/workflows/vulnerable11.yml:18:20:18:57 | github.event.pull_request.title | ${{ github.event.pull_request.title }} | .github/workflows/vulnerable11.yml:3:3:3:21 | pull_request_target | pull_request_target |
| .github/workflows/vulnerable11.yml:19:19:19:55 | github.event.pull_request.body | .github/workflows/vulnerable11.yml:19:19:19:55 | github.event.pull_request.body | .github/workflows/vulnerable11.yml:19:19:19:55 | github.event.pull_request.body | Potential prompt injection in $@, which may be controlled by an external user ($@). | .github/workflows/vulnerable11.yml:19:19:19:55 | github.event.pull_request.body | ${{ github.event.pull_request.body }} | .github/workflows/vulnerable11.yml:3:3:3:21 | pull_request_target | pull_request_target |