🐛 detect toJSON(github.event) in Dangerous-Workflow check

[heathdutton]

What kind of change does this PR introduce?

Bug fix

• PR title follows the guidelines defined in our pull request documentation

What is the current behavior?

The Dangerous-Workflow check does not detect script injection vulnerabilities when toJSON(github.event) or toJSON(github) is used in workflow run steps. These serialize the entire event/context object which contains attacker-controlled data.

What is the new behavior (if this is a feature change)?

The check now detects toJSON(github.event) and toJSON(github) patterns as dangerous, including case variations and whitespace.

• Tests for the changes have been added (for bug fixes/features)

Which issue(s) this PR fixes

Fixes #3554

Special notes for your reviewer

The regex (?i)tojson\s*\(\s*github(\s*\)|\.event) matches:

• toJSON(github) - serializes entire context including event
• toJSON(github.event) and toJSON(github.event.*) - serializes event data
• Case insensitive and handles whitespace

It correctly ignores safe patterns like toJSON(github.repository).

Does this PR introduce a user-facing change?

Dangerous-Workflow check now detects toJSON(github.event) and toJSON(github) as dangerous patterns

[spencerschrock]

I think if we just focus on toJSON(github) and to.JSON(github.event) (and not any other subfields) we avoid false positives for now, while we think of how to get the specificity right.

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 69.70%. Comparing base (353ed60) to head (240a790).
⚠️ Report is 303 commits behind head on main.

Additional details and impacted files

@@            Coverage Diff             @@
##             main    #4898      +/-   ##
==========================================
+ Coverage   66.80%   69.70%   +2.90%     
==========================================
  Files         230      251      +21     
  Lines       16602    15652     -950     
==========================================
- Hits        11091    10911     -180     
+ Misses       4808     3867     -941     
- Partials      703      874     +171     

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

[spencerschrock]

/scdiff generate Dangerous-Workflow

[github-actions]

Here's a link to the scdiff run