Predicate stepsCtxLocalStep
Holds if there is a local flow step between a ${{ steps.xxx.outputs.yyy }} expression accesing a step output field and the step output itself. But only for those cases where the step output is defined externally in a MaD Source specification. The reason for this is that we don’t currently have a way to specify that a source starts with a non-empty access path so we cannot write a Source that stores the taint in a Content, we can only do that for steps (storeStep). The easiest thing is to add this local flow step that simulates a read step from the source node for a specific field name.
Import path
import codeql.actions.dataflow.internal.DataFlowPrivatepredicate stepsCtxLocalStep(Node nodeFrom, Node nodeTo)