CodeQL 2.26.3 Adds Vue Modeling, Fixes GitHub Actions Queries, and Removes SelfHostedQuery Module

GitHub released CodeQL 2.26.3, which introduces source modeling for Vue.js and improves the accuracy of several GitHub Actions queries. The update also includes a breaking change affecting custom queries.

Breaking Change: SelfHostedQuery Module Removal

CodeQL 2.26.3 removes the codeql.actions.security.SelfHostedQuery module. The vendor states this is necessary because runner labels do not reliably distinguish self-hosted runners from managed runners. Users relying on this module in custom queries must update their code.

GitHub Actions Improvements

The update recognizes untrusted data in github.event.merge_group for workflows triggered by the merge_group event. Several security queries have been refined:

  • actions/output-clobbering/high: No longer reports simple jq path filters when output remains JSON-encoded. A performance issue caused by unescaped regular expression input has also been fixed.
  • actions/cache-poisoning/*: These queries now account for read-only cache access on low-trust triggers running in the default branch scope. Results are retained only for triggers allowed to write to that cache scope.
  • actions/envvar-injection/critical: Requires the untrusted source and privileged context to originate from the same trigger event. Pull request head labels are no longer treated as injection-capable since they cannot contain newlines.

JavaScript, TypeScript, and Vue Modeling

CodeQL 2.26.3 adds source modeling for JavaScript, TypeScript, and Vue. Custom models can now reference specific files using a package name in the form file:<path>.

For Vue, flow models have been added for the Composition API helpers ref, shallowRef, toRef, reactive, and computed. Vue Router's useRoute() Composition API is now recognized as a client-side remote flow source, including its query, params, path, fullPath, and hash members. Additionally, declared inputs properties in Sails Action2 controller files are treated as remote flow sources.

Other Language Updates

C/C++: Flow source models have been added for RegQueryValue and related functions from the Windows winreg.h header.

Ruby: Library input from vendored gems has been removed from the set of taint sources, which should reduce false positives for several queries.

General: Queries using the response threat model now track promise-wrapped client response data into promise fulfillment values, improving results for queries such as js/xss.