Fix error in select

Casting to CachingWritingStep in the select clause was shadowing all the Poisonable result

Author: Alvaro Muñoz

ql/src/Security/CWE-349/CachePoisoning.ql

@@ -22,13 +22,16 @@ where
   // TODO: (require to collect trigger types)
   // - add push to default branch?
   // - exclude pull_request_target when branches_ignore includes default branch or when branches does not include the default branch
-  j.getEnclosingWorkflow()
-      .hasTriggerEvent([
-          "check_run", "check_suite", "delete", "discussion", "discussion_comment", "fork",
-          "gollum", "issue_comment", "issues", "label", "milestone", "project", "project_card",
-          "project_column", "public", "pull_request_comment", "pull_request_target",
-          "repository_dispatch", "schedule", "watch", "workflow_run"
-        ]) and
+  (
+    j.getEnclosingWorkflow().hasTriggerEvent(defaultBranchTriggerEvent())
+    or
+    j.getEnclosingWorkflow().hasTriggerEvent("workflow_call") and
+    exists(ExternalJob call, Workflow caller |
+      call.getCallee() = j.getLocation().getFile().getRelativePath() and
+      caller = call.getWorkflow() and
+      caller.hasTriggerEvent(defaultBranchTriggerEvent())
+    )
+  ) and
   // The job checkouts untrusted code from a pull request
   j.getAStep() = checkout and
   (
@@ -40,4 +43,4 @@ where
     // (The cache specific token can be leaked even for non-privileged workflows)
     checkout.getAFollowingStep() instanceof PoisonableStep
   )
-select j.getAStep().(CacheWritingStep), "Potential cache poisoning on privileged workflow."
+select checkout, "Potential cache poisoning on privileged workflow."

ql/test/query-tests/Security/CWE-349/.github/workflows/test8.yml

@@ -0,0 +1,19 @@
+on:
+  issue_comment:
+    types: [created]
+
+jobs:
+  pr-comment:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: xt0rted/pull-request-comment-branch@v2
+        id: comment-branch
+
+      - uses: actions/checkout@v3
+        if: success()
+        with:
+          ref: ${{ steps.comment-branch.outputs.head_sha }}
+
+      - run: |
+          ./checkedout/poison
+