@@ -237,12 +237,12 @@ module Actions {
     /**
      * Holds if `${{ e }}` is a GitHub Actions expression evaluated within this `run` command.
      * See https://docs.github.com/en/free-pro-team@latest/actions/reference/context-and-expression-syntax-for-github-actions.
+     * Only finds simple expressions like `${{ github.event.comment.body }}`, where the expression contains only alphanumeric characters, underscores, dots, or dashes.
+     * Does not identify more complicated expressions like `${{ fromJSON(env.time) }}`, or ${{ format('{{Hello {0}!}}', github.event.head_commit.author.name) }}
      */
-    string getAReferencedExpression() {
+    string getASimpleReferenceExpression() {
       // We use `regexpFind` to obtain *all* matches of `${{...}}`,
       // not just the last (greedy match) or first (reluctant match).
-      // TODO: This only handles expression strings that refer to contexts.
-      // It does not handle operators within the expression.
       result =
         this.getValue()
             .regexpFind("\\$\\{\\{\\s*[A-Za-z0-9_\\.\\-]+\\s*\\}\\}", _, _)
 
@@ -80,7 +80,7 @@ private predicate isExternalUserControlledDiscussion(string context) {
 
 from Actions::Run run, string context, Actions::On on
 where
-  run.getAReferencedExpression() = context and
+  run.getASimpleReferenceExpression() = context and
   run.getStep().getJob().getWorkflow().getOn() = on and
   (
     exists(on.getNode("issues")) and
Original file line number	Diff line number	Diff line change
`@@ -80,7 +80,7 @@ private predicate isExternalUserControlledDiscussion(string context) {`
`80`	`80`
`81`	`81`	`from Actions::Run run, string context, Actions::On on`
`82`	`82`	`where`
`83`		`- run.getAReferencedExpression() = context and`
	`83`	`+ run.getASimpleReferenceExpression() = context and`
`84`	`84`	`run.getStep().getJob().getWorkflow().getOn() = on and`
`85`	`85`	`(`
`86`	`86`	`exists(on.getNode("issues")) and`