Thanks for this contribution. Before I review this, can I ask how you came across this problem, and why you want it fixed. Did you experience FPs caused by it? Or did you find the issue that you linked to? From my point of view this is quite a lot of added complication in the code for a low value FP fix. There are other things that we could be spending time on that would improve CodeQL more.

I came across #15894 while looking for a way to contribute and reproduced it locally. Fair point about the added complexity. I'm happy to pick up something higher priority.

What languages are you interested in working on? Since our support for Rust is much newer, there are some FPs to fix there which would be much more impactful. CodeQL for actions is also a newly-supported language, where there are lots of things that could be improved.

Another way to contribute is to add queries that we have for some languages to other languages where they are missing. For example, I used Copilot to make #22019 (C#) but I haven't had a chance to review it. I also wanted to adopt this request forgery query for C# written by Microsoft on their fork of CodeQL.

Complicated modelling is also very welcome, like your Spring MVC PR.

Thanks, Owen! I'm open to working across languages, though I'd lean toward GitHub Actions over Rust. Is there a specific issue you'd like me to prioritize?

#19635
Probably the best way is looking at open issues. It's probably also worth looking at open PRs relating to CodeQL for Actions to check what's in progress. Unfortunately there isn't much capacity for reviewing Actions PRs at the moment.