CodeQL v2.26.4 支持 Go 1.27，GitHub Actions 检测逻辑变更
CodeQL 2.26.4 improves GitHub actions security detections
GitHub Actions 安全检测逻辑变更（如 actor 字段检查收紧、unpinned-tag 扩展）可能导致现有 CI/CD 流水线出现意外告警激增，建议开发者在 GHES 升级前或在本地验证相关 Query 行为，避免生产环境阻断。
CodeQL is the static analysis engine behind GitHub code scanning, which finds and remediates security issues in your code. We’ve recently released CodeQL 2.26.4, which adds support for Go 1.27, improves alert locations for Rust data flow queries, and includes accuracy improvements across C#, Java/Kotlin, and GitHub Actions.
CodeQL 是 GitHub 代码扫描背后的静态分析引擎，用于发现和修复代码中的安全问题。我们最近发布了 CodeQL 2.26.4，新增了对 Go 1.27 的支持，改进了 Rust 数据流查询的告警位置，并提升了 C#、Java/Kotlin 和 GitHub Actions 方面的准确性。
Language and framework support
语言和框架支持
Go
Go
- CodeQL now supports Go 1.27.
- CodeQL 现在支持 Go 1.27。
Rust
Rust
- Alert locations for data flow queries are now more precise and are based on the actual source and sink nodes. Some alerts will change location, so they’ll appear as new alerts while the previous alerts close.
- 数据流查询的告警位置现在更加精确，基于实际的源节点和汇节点。部分告警的位置会发生变化，因此它们将显示为新告警，而之前的告警将关闭。
Java/Kotlin
Java/Kotlin
- We’ve added SQL injection sink models for Spring R2DBC DatabaseClient and the R2DBC SPI.
- Taint now propagates through calls to String.valueOf(Object) when the argument is a CharSequence (e.g., a String or a StringBuilder).
- 我们为 Spring R2DBC DatabaseClient 和 R2DBC SPI 添加了 SQL 注入汇模型。
- 当参数为 CharSequence（例如 String 或 StringBuilder）时，污点现在会通过调用 String.valueOf(Object) 传播。
JavaScript/TypeScript
JavaScript/TypeScript
- We’ve added support for regular expressions using the d flag and for the React Native Worklets 'worklet' directive.
- 我们新增了对使用 d 标志的正则表达式以及 React Native Worklets 'worklet' 指令的支持。
Python
Python
- We’ve added taint flow through list.extend and list.insert, matching the existing taint flow through list.append.
- 我们新增了通过 list.extend 和 list.insert 进行的污点流传播，与现有的通过 list.append 进行的污点流传播保持一致。
Query changes
查询变更
C#
C#
- The cs/web/missing-token-validation query now recognizes enabled ASP.NET Core RequireAntiforgeryToken attributes when antiforgery middleware is used.
- The cs/virtual-call-in-constructor query no longer reports uses of virtual members in nameof expressions, since they aren’t calls.
- The cs/useless-cast-to-self and cs/simplifiable-boolean-expression queries produce fewer false positives in build-mode: none databases.
- cs/web/missing-token-validation 查询现在在使用反伪造中间件时，能够识别已启用的 ASP.NET Core RequireAntiforgeryToken 属性。
- cs/virtual-call-in-constructor 查询不再报告 nameof 表达式中对虚拟成员的使用，因为它们不是调用。
- cs/useless-cast-to-self 和 cs/simplifiable-boolean-expression 查询在 build-mode: none 数据库中产生的误报更少。
GitHub Actions
GitHub Actions
- Checks on actor fields read from the event payload (e.g., github.event.pull_request.user.login) now only count as protection for events that actually populate that field. This may produce more alerts for queries that use the ControlCheck class.
- The actions/unpinned-tag query now detects mutable references to reusable workflows.
- You can now specify EnvironmentCheck through a models-as-data model. Queries using ControlCheck may find more results when an environment is no longer a sufficient sanitizer.
- 对从事件负载中读取的操作者字段（例如 github.event.pull_request.user.login）的检查，现在仅对实际填充该字段的事件计为保护措施。这可能会导致使用 ControlCheck 类的查询产生更多告警。
- actions/unpinned-tag 查询现在可检测对可重用工作流的可变引用。
- 您现在可以通过 models-as-data 模型指定 EnvironmentCheck。当环境不再是足够的清理器时，使用 ControlCheck 的查询可能会找到更多结果。
For a full list of changes, please refer to the complete changelog for version 2.26.4. Every new version of CodeQL is automatically deployed to users of GitHub code scanning on github.com. The new functionality in CodeQL 2.26.4 will also be included in a future GitHub Enterprise Server (GHES) release. If you use an older version of GHES, you can manually upgrade your CodeQL version.
有关完整的变更列表，请参阅版本 2.26.4 的完整更新日志。每个新版本的 CodeQL 都会自动部署到 github.com 上 GitHub 代码扫描的用户。CodeQL 2.26.4 中的新功能也将包含在未来的 GitHub Enterprise Server (GHES) 版本中。如果您使用的是旧版本的 GHES，可以手动升级您的 CodeQL 版本。
The post CodeQL 2.26.4 improves GitHub actions security detections appeared first on The GitHub Blog.
CodeQL 2.26.4 提升 GitHub Actions 安全检测的文章首先发布于 The GitHub Blog。
更进一步：量化金融体系
看懂新闻只是起点——沿量化金融路径，把它变成能交付的工程能力