Actions: Add new query `actions/code-injection/low` for code injection with step outputs

Open owen-mc opened this issue 1 month ago • 1 comments

This has low precision but can catch serious issues. However, because of its low precision, it won't be included in any of our query suites. I'm not sure what to do about that.

The allowlist of actions whose outputs are not user-controlled was generated by copilot, using results from running this query on many repos using MRVA. I do not have the expertise to be sure that it is correct, so please check this. I am also interested in any other actions to add to the allowlist. Possibly we could allow users to add safe actions using data extensions, if there is demand.

Dec 05 '25 16:12 owen-mc

@adityasharad Are you able to review this? CI was failing but rebasing has resolved it.

Dec 13 '25 22:12 owen-mc