CodeQL 2.26.4 Enhances Security Detection in GitHub Actions
The update boosts security detection for ASP.NET Core and GitHub Actions workflows.
CodeQL 2.26.4 has been released with significant improvements in security detection capabilities. The update enhances the cs/web/missing-token-validation query to recognize enabled ASP.NET Core RequireAntiforgeryToken attributes when antiforgery middleware is used. This change strengthens security analysis for ASP.NET Core applications by ensuring that token validation is properly detected.
In addition, the actions/unpinned-tag query now detects mutable references to reusable workflows. This enhancement aims to improve the security of GitHub Actions workflows by identifying potential vulnerabilities related to unpinned tags.
The new functionality in CodeQL 2.26.4 will be included in a future GitHub Enterprise Server release. Meanwhile, every new version of CodeQL is automatically deployed to users of GitHub code scanning on github.com.
For more details, visit the GitHub Changelog.
Sources
- CodeQL 2.26.4 improves GitHub actions security detections Primary GitHub Changelog
Researched and drafted with AI assistance from the primary sources listed above, then checked against those sources before publication. Every factual claim here is traceable to a cited source; where the sources are silent, so are we. How this works.