Actions: Avoid output-clobbering alerts for JSON-encoded jq output

[JarLob]

Reduce false positives from the experimental actions/output-clobbering/high query when jq output can be conservatively proven to remain JSON-encoded.

The query recognizes a bounded set of safe command forms:

• Simple identity, property, and numeric-index path filters
• Single- or double-quoted simple filters
• Known non-raw options before or after the filter
• Literal input paths

Unrecognized commands remain reportable. In particular, the query continues to report:

• Raw-output modes such as -r, -j, --raw-output, --raw-output0, and --join-output
• Filters using raw-emitting operations such as stderr or halt_error
• Complex filters and unrecognized options

This intentionally favors avoiding false negatives over suppressing every safe jq invocation.

[Copilot]

Pull request overview

Refines the output-clobbering query to recognize JSON-encoded jq output while preserving alerts for raw-output modes.

Changes:

• Adds jq output-mode detection.
• Adds regression workflows and expected results.
• Documents the analysis improvement.

Show a summary per file

File	Description
OutputClobberingQuery.qll	Excludes recognized JSON-encoded jq output.
.github/workflows/output2.yml	Adds safe and vulnerable jq cases.
OutputClobberingHigh.expected	Updates expected query results.
2026-07-29-output-clobbering-jq-precision.md	Adds the change note.

Review details

• Files reviewed: 4/4 changed files
• Comments generated: 2
• Review effort level: Medium

[Copilot]

Review details

Comments suppressed due to low confidence (1)

actions/ql/test/query-tests/Security/CWE-074/.github/workflows/output2.yml:66

• This safe case needs a vulnerable pipeline control. getACommand() splits pipelines, so for jq '.value' pr-number.json | tr -d '"' the matched clobbering_cmd is still the safe-looking jq segment and this PR suppresses the statement, even though the downstream command removes JSON quoting and can emit a workflow command. Restrict suppression to cases where the jq output reaches the runner unchanged, and add this regression case.

          # NOT VULNERABLE: jq emits JSON-encoded strings by default
          jq '.value' pr-number.json

• Files reviewed: 4/4 changed files
• Comments generated: 0 new
• Review effort level: Medium