GitHub Enhances CodeQL with Improved JavaScript Analysis and Security Queries

GitHub has released an update to its CodeQL static analysis engine, version 2.26.3, which enhances GitHub Actions security queries and JavaScript analysis. This latest version of CodeQL delivers significant improvements for modern JavaScript frameworks, particularly in dynamic client-side applications where security risks like XSS (cross-site scripting) are prevalent.

The update introduces source and flow models for Vue's Composition API helpers, such as ref and computed, and recognizes Vue Router's useRoute() method as a client-side remote flow source. These changes enhance the tool's ability to detect vulnerabilities in modern JavaScript frameworks.

For GitHub Actions, the update enhances the accuracy of several critical queries, including those targeting cache poisoning and environment variable injection vulnerabilities. The actions/envvar-injection/critical query now factors in the origin trigger event, tightening its scope and reducing false positives.