Account for branches filter as a way to prevent workflow_run to trigger on PRs from forks

Author: Alvaro Muñoz

ql/lib/codeql/actions/ast/internal/Ast.qll

@@ -722,13 +722,10 @@ class EventImpl extends AstNodeImpl, TEventNode {
     not this.getName() = "workflow_run"
     or
     this.getName() = "workflow_run" and
-    // workflow_run cannot be externally triggered if they triggering workflow runs in the context of the default branch
-    // since an attacker can change the triggering workflow from any event to `pull_request` to trigger the workflow
-    // but in that case, the triggering workflow will run in the context of the PR head branch
-    (
-      not exists(this.getAPropertyValue("branches")) or
-      this.getAPropertyValue("branches").matches("%*%")
-    )
+    // workflow_run cannot be externally triggered if the triggering workflow runs in the context of the default branch
+    // An attacker can change the triggering workflow from any event to `pull_request` to trigger the workflow
+    // in that case, the triggering workflow will run in the context of the PR head branch
+    not exists(this.getAPropertyValue("branches"))
     or
     // the event is `workflow_call` and there is a caller workflow that can be triggered externally
     this.getName() = "workflow_call" and

ql/lib/ext/config/argument_injection_sinks.yml

@@ -3,7 +3,14 @@ extensions:
       pack: github/actions-all
       extensible: argumentInjectionSinksDataModel
     # https://gtfobins.github.io/
+    # https://0xn3va.gitbook.io/cheat-sheets/web-application/command-injection/argument-injection
     data:
       - ["(awk)(.*?)", 2, 3]
+      - ["(curl)(.*?)", 2, 3]
+      - ["(find)(.*?)", 2, 3]
+      - ["(git)(.*?)", 2, 3]
       - ["(sed)(.*?)", 2, 3]
+      - ["(tar)(.*?)", 2, 3]
+      - ["(wget)(.*?)", 2, 3]
+      - ["(zip)(.*?)", 2, 3]