Skip to content

spec: add CTR-012 and update rule mappings in compiler threat detection spec (v1.0.2)#31135

Merged
pelikhan merged 2 commits intomainfrom
copilot/ctr-012-add-rule-mappings
May 9, 2026
Merged

spec: add CTR-012 and update rule mappings in compiler threat detection spec (v1.0.2)#31135
pelikhan merged 2 commits intomainfrom
copilot/ctr-012-add-rule-mappings

Conversation

Copy link
Copy Markdown
Contributor

Copilot AI commented May 9, 2026

Daily threat spec optimizer reconciled four existing implementation files missing from the Section 6.1 mapping table, and formally specifies a new rule CTR-012 for the safe-outputs wildcard push scope threat.

Changes

New Rule: CTR-012 Safe-Outputs Wildcard Push Scope

Covers push_to_pull_request_branch_validation.go — detects two misconfiguration patterns when target: "*" is set:

  • No wildcard fetch: agent can't reach arbitrary PR branches without fetch: ["*"] in checkout (suppressed for public repos)
  • No access constraints: no title-prefix or labels means unconstrained write scope over all PRs

Distinct from CTR-008 (pwn-request via pull_request_target) — CTR-012 is scoped to the safe-outputs subsystem.

Mapping Updates (Section 6.1)

Rule File Added
CTR-001 github_app_permissions_validation.go
CTR-006 heredoc_validation.go
CTR-010 expression_syntax_validation.go
CTR-011 strict_mode_network_validation.go + description extended to cover wildcard * domain rejection

Spec bumped from v1.0.1 → v1.0.2.

…on spec v1.0.2

Co-authored-by: pelikhan <4175913+pelikhan@users.noreply.github.com>
Copilot AI changed the title [WIP] Add CTR-012 and update rule mappings in compiler threat detection spec spec: add CTR-012 and update rule mappings in compiler threat detection spec (v1.0.2) May 9, 2026
Copilot AI requested a review from pelikhan May 9, 2026 03:41
@pelikhan pelikhan marked this pull request as ready for review May 9, 2026 03:50
Copilot AI review requested due to automatic review settings May 9, 2026 03:50
@pelikhan pelikhan merged commit bc6ba7a into main May 9, 2026
@pelikhan pelikhan deleted the copilot/ctr-012-add-rule-mappings branch May 9, 2026 03:50
Copy link
Copy Markdown
Contributor

Copilot AI left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Pull request overview

Updates the compiler threat detection specification to add a new rule (CTR-012) and reconcile rule-to-implementation mappings for several already-implemented validations, bumping the spec version accordingly.

Changes:

  • Bump spec version to v1.0.2 and update publication date.
  • Add CTR-012 Safe-Outputs Wildcard Push Scope to the core rule catalog and Section 6.1 mapping table.
  • Update Section 6.1 mappings for CTR-001 / CTR-006 / CTR-010 / CTR-011 and record the changes in the changelog.
Show a summary per file
File Description
specs/compiler-threat-detection-spec.md Adds CTR-012 and updates Section 6.1 rule mappings + changelog for v1.0.2.

Copilot's findings

Tip

Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

  • Files reviewed: 1/1 changed files
  • Comments generated: 2

| CTR-004 Sandbox Bypass Configuration | `pkg/workflow/sandbox_validation*.go`, `pkg/workflow/strict_mode_sandbox_validation*.go` | `pkg/workflow/*sandbox*_test.go` |
| CTR-005 Unsafe Output Route | `pkg/workflow/compiler_safe_outputs*.go`, `pkg/workflow/safe_outputs*.go` | `pkg/workflow/*safe_outputs*_test.go` |
| CTR-006 Template Injection | `pkg/workflow/template_injection_validation.go` | `pkg/workflow/template_injection_validation_test.go`, `pkg/workflow/template_injection_validation_fuzz_test.go` |
| CTR-006 Template Injection | `pkg/workflow/template_injection_validation.go`, `pkg/workflow/heredoc_validation.go` | `pkg/workflow/template_injection_validation_test.go`, `pkg/workflow/template_injection_validation_fuzz_test.go` |
| CTR-009 Shell Expansion in Safe-Outputs | `pkg/workflow/safe_outputs_steps_shell_expansion_validation.go` | `pkg/workflow/safe_outputs_steps_shell_expansion_validation_test.go` |
| CTR-010 Expression Safety Allowlist | `pkg/workflow/expression_safety_validation.go` | `pkg/workflow/expression_extraction_test.go` |
| CTR-011 Network Firewall Configuration | `pkg/workflow/network_firewall_validation.go`, `pkg/workflow/firewall_validation.go` | `pkg/workflow/network_firewall_validation_test.go` |
| CTR-010 Expression Safety Allowlist | `pkg/workflow/expression_safety_validation.go`, `pkg/workflow/expression_syntax_validation.go` | `pkg/workflow/expression_extraction_test.go` |
Copilot AI added a commit that referenced this pull request May 9, 2026
…on spec (v1.0.2) (#31135)

Co-authored-by: pelikhan <4175913+pelikhan@users.noreply.github.com>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

[compiler-threat-spec] spec: add CTR-012 and update rule mappings in compiler threat detection spec

3 participants