Added matrix include test

Author: JarLob

actions/ql/lib/codeql/actions/ast/internal/Ast.qll

@@ -1874,7 +1874,14 @@ class MatrixExpressionImpl extends SimpleReferenceExpressionImpl {
     exists(StrategyImpl s, MatrixAccessPathImpl p, ScalarValueImpl v |
       (s = this.getEnclosingJob().getStrategy() or s = this.getEnclosingWorkflow().getStrategy()) and
       p.toString() = fieldAccess and
-      resolveMatrixAccessPath(s.getMatrix(), p).getNode(_) = v.getNode() and
+      (
+        resolveMatrixAccessPath(s.getMatrix(), p).getNode(_) = v.getNode()
+        or
+        resolveMatrixAccessPath(
+          s.getMatrix().lookup("include").(YamlSequence).getElementNode(_).(YamlMappingLikeNode),
+          p
+        ).getNode(_) = v.getNode()
+      ) and
       // Exclude values containing matrix expressions to avoid recursion
       not exists(MatrixExpressionImpl e | e.getParentNode() = v) and
       result = v.getValue()
@@ -1903,7 +1910,7 @@ class MatrixAccessPathImpl extends TMatrixAccessPathNode {
 }
 
 private YamlMappingLikeNode resolveMatrixAccessPath(
-  // TODO: support `include` and `exclude` keys
+  // TODO: support `exclude` keys
   // https://docs.github.com/en/actions/using-jobs/using-a-matrix-for-your-jobs#expanding-or-adding-matrix-configurations
   YamlMappingLikeNode root, MatrixAccessPathImpl accessPath
 ) {

actions/ql/test/query-tests/Security/CWE-349/.github/workflows/dynamic_matrix_include_ref.yml

@@ -0,0 +1,17 @@
+on: issue_comment
+
+jobs:
+  test:
+    runs-on: ubuntu-latest
+    strategy:
+      matrix:
+        ref: ["main"]
+        include:
+          - ref: "${{ github.event.comment.body }}"
+    steps:
+      - uses: actions/checkout@v4
+        with:
+          repository: example/example
+          ref: ${{ matrix.ref }}
+      # VULNERABLE: an included job checks out a ref controlled by the event payload.
+      - run: npm install

actions/ql/test/query-tests/Security/CWE-349/CachePoisoningViaDirectCache.expected

@@ -17,6 +17,7 @@ edges
 | .github/workflows/direct_cache5.yml:17:9:21:6 | Uses Step | .github/workflows/direct_cache5.yml:21:9:22:21 | Run Step |
 | .github/workflows/direct_cache6.yml:13:9:16:6 | Uses Step | .github/workflows/direct_cache6.yml:16:9:20:6 | Uses Step |
 | .github/workflows/direct_cache6.yml:16:9:20:6 | Uses Step | .github/workflows/direct_cache6.yml:20:9:26:46 | Uses Step: cache-pip |
+| .github/workflows/dynamic_matrix_include_ref.yml:12:9:17:6 | Uses Step | .github/workflows/dynamic_matrix_include_ref.yml:17:9:17:24 | Run Step |
 | .github/workflows/dynamic_matrix_ref.yml:10:9:15:6 | Uses Step | .github/workflows/dynamic_matrix_ref.yml:15:9:15:24 | Run Step |
 | .github/workflows/neg_direct_cache1.yml:14:9:17:6 | Uses Step | .github/workflows/neg_direct_cache1.yml:17:9:21:6 | Uses Step |
 | .github/workflows/neg_direct_cache1.yml:17:9:21:6 | Uses Step | .github/workflows/neg_direct_cache1.yml:21:9:22:21 | Run Step |

actions/ql/test/query-tests/Security/CWE-349/CachePoisoningViaPoisonableStep.expected

@@ -24,6 +24,8 @@ edges
 | .github/workflows/direct_cache6.yml:13:9:16:6 | Uses Step | .github/workflows/direct_cache6.yml:16:9:20:6 | Uses Step |
 | .github/workflows/direct_cache6.yml:15:17:15:57 | github.event.pull_request.head.sha | .github/workflows/direct_cache6.yml:13:9:16:6 | Uses Step |
 | .github/workflows/direct_cache6.yml:16:9:20:6 | Uses Step | .github/workflows/direct_cache6.yml:20:9:26:46 | Uses Step: cache-pip |
+| .github/workflows/dynamic_matrix_include_ref.yml:12:9:17:6 | Uses Step | .github/workflows/dynamic_matrix_include_ref.yml:17:9:17:24 | Run Step |
+| .github/workflows/dynamic_matrix_include_ref.yml:15:17:15:33 | matrix.ref | .github/workflows/dynamic_matrix_include_ref.yml:12:9:17:6 | Uses Step |
 | .github/workflows/dynamic_matrix_ref.yml:10:9:15:6 | Uses Step | .github/workflows/dynamic_matrix_ref.yml:15:9:15:24 | Run Step |
 | .github/workflows/dynamic_matrix_ref.yml:13:17:13:33 | matrix.ref | .github/workflows/dynamic_matrix_ref.yml:10:9:15:6 | Uses Step |
 | .github/workflows/neg_direct_cache1.yml:14:9:17:6 | Uses Step | .github/workflows/neg_direct_cache1.yml:17:9:21:6 | Uses Step |
@@ -69,6 +71,7 @@ edges
 | .github/workflows/poisonable_step5.yml:20:17:20:57 | github.event.pull_request.head.ref | .github/workflows/poisonable_step5.yml:17:9:22:6 | Uses Step |
 | .github/workflows/poisonable_step5.yml:22:9:24:6 | Uses Step | .github/workflows/poisonable_step5.yml:24:9:28:31 | Uses Step |
 #select
+| .github/workflows/dynamic_matrix_include_ref.yml:17:9:17:24 | Run Step | .github/workflows/dynamic_matrix_include_ref.yml:15:17:15:33 | matrix.ref | .github/workflows/dynamic_matrix_include_ref.yml:17:9:17:24 | Run Step | Potential cache poisoning in the context of the default branch due to privilege checkout of untrusted code from $@. ($@). | .github/workflows/dynamic_matrix_include_ref.yml:15:17:15:33 | matrix.ref | matrix.ref | .github/workflows/dynamic_matrix_include_ref.yml:1:5:1:17 | issue_comment | issue_comment |
 | .github/workflows/dynamic_matrix_ref.yml:15:9:15:24 | Run Step | .github/workflows/dynamic_matrix_ref.yml:13:17:13:33 | matrix.ref | .github/workflows/dynamic_matrix_ref.yml:15:9:15:24 | Run Step | Potential cache poisoning in the context of the default branch due to privilege checkout of untrusted code from $@. ($@). | .github/workflows/dynamic_matrix_ref.yml:13:17:13:33 | matrix.ref | matrix.ref | .github/workflows/dynamic_matrix_ref.yml:1:5:1:17 | issue_comment | issue_comment |
 | .github/workflows/poisonable_step1.yml:15:9:17:2 | Run Step | .github/workflows/poisonable_step1.yml:14:17:14:60 | steps.comment-branch.outputs.head_sha | .github/workflows/poisonable_step1.yml:15:9:17:2 | Run Step | Potential cache poisoning in the context of the default branch due to privilege checkout of untrusted code from $@. ($@). | .github/workflows/poisonable_step1.yml:14:17:14:60 | steps.comment-branch.outputs.head_sha | steps.comment-branch.outputs.head_sha | .github/workflows/poisonable_step1.yml:2:3:2:15 | issue_comment | issue_comment |
 | .github/workflows/poisonable_step1.yml:26:9:28:2 | Uses Step | .github/workflows/poisonable_step1.yml:25:17:25:60 | steps.comment-branch.outputs.head_sha | .github/workflows/poisonable_step1.yml:26:9:28:2 | Uses Step | Potential cache poisoning in the context of the default branch due to privilege checkout of untrusted code from $@. ($@). | .github/workflows/poisonable_step1.yml:25:17:25:60 | steps.comment-branch.outputs.head_sha | steps.comment-branch.outputs.head_sha | .github/workflows/poisonable_step1.yml:2:3:2:15 | issue_comment | issue_comment |