Prevent jscpd and secretlint report-folder race - #8633
Open
trevor-vaughan wants to merge 1 commit into
Open
Conversation
trevor-vaughan
force-pushed
the
fix/3979-secretliner-and-jscpd-toctou
branch
from
August 4, 2026 22:05
115b673 to
41dbebc
Compare
trevor-vaughan
force-pushed
the
fix/3979-secretliner-and-jscpd-toctou
branch
from
August 4, 2026 22:29
41dbebc to
d23b785
Compare
TextReporter runs per linter the moment it finishes, so JsCpdLinter's
rmtree of megalinter-reports/copy-paste fired while secretlint was still
scanning the workspace in project mode. secretlint had already globbed
the jscpd report into its target set, crashed with ENOENT reading it, and
its stack trace was then parsed as SARIF and counted as a finding.
jscpd now writes its report to a temp folder outside the workspace and
copies it in only when clones are found, so MegaLinter never deletes files
other linters are scanning. secretlint gets a generated ignore file in the
report folder that merges the user's patterns with an exclusion for that
folder alone; narrowing a secrets scanner further would hide credentials
baked into build artifacts.
- fix: report a linter with unparsable SARIF as a warning, not a success
- A linter exiting 0 while emitting a stack trace instead of SARIF was
counted as zero findings and shown green; affects linters declaring
can_output_sarif (REPOSITORY_SECRETLINT, REPOSITORY_SEMGREP,
REPOSITORY_TRIVY). A linter that dies before producing SARIF now fails
with its raw output instead of a phantom finding.
- fix(secretlint): honor ignore patterns when REPORT_OUTPUT_FOLDER is off
- The generated ignore file was only written when reports could be
written; otherwise it fell back to passing a base name, so a
.secretlintignore under LINTER_RULES_PATH silently applied nothing. It
now goes to a temp folder outside the workspace, and the
--secretlintignore=<value> argument form is parsed too.
- fix(secretlint): stop falling back to .gitignore for a missing ignore file
- A typo in --secretlintignore used to promote .gitignore patterns to
authoritative status, excluding the very files a secrets scanner exists
to inspect. It now degrades with a warning and applies no fallback.
- fix(config): always exclude REPORT_OUTPUT_FOLDER from linted directories
- An EXCLUDED_DIRECTORIES override could drop it, making MegaLinter lint
its own output while reporters were still writing to it.
- test: cover jscpd report wiring and isolate ambient env in unit tests
- docs: document the secretlint ignore model and report-folder exclusion
Fixes: oxsecurity#3979
Assisted-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Signed-off-by: Trevor Vaughan <peiriannydd@gmail.com>
trevor-vaughan
force-pushed
the
fix/3979-secretliner-and-jscpd-toctou
branch
from
August 5, 2026 14:07
d23b785 to
62f1187
Compare
trevor-vaughan
marked this pull request as ready for review
August 5, 2026 14:51
trevor-vaughan
requested review from
Kurt-von-Laven,
bdovaz,
echoix and
nvuillam
as code owners
August 5, 2026 14:51
Member
|
@trevor-vaughan I am currently building a generic way of dynamically inject cli args / ignore files to all linters called in project cli_lint_mode I think it will solve your use case (and many others), please tell me if you have any remarks :) |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
When
COPYPASTE_JSCPDandREPOSITORY_SECRETLINTran in parallel, jscpd's per-linter cleanup deletedmegalinter-reports/copy-pastewhile secretlint was still scanning the workspace, producing sporadicENOENTcrashes whose stack traces were then parsed as SARIF findings. This fixes the race by keeping jscpd's report out of the shared workspace until clones are found and by giving secretlint a generated ignore file that excludes only MegaLinter's own report folder. It also hardens SARIF result counting and the secretlint ignore-file handling so a crashed or misconfigured secrets scanner can no longer be reported as clean.Assisted-By: Claude Opus 5 (1M context) noreply@anthropic.com
Closes: #3979
Changes
copy-paste/only when clones are found, so no file another linter is scanning is ever deleted mid-run; a stale report from a previous run is cleared at construction time.copy-paste/folder is chmod'd to 0755 so a later non-root artifact-upload step can read it, instead of inheriting mkdtemp's 0700..secretlintignore-megalinterfile (in the report folder, or a temp folder when reports are disabled), honoring a file named inLINTER_RULES_PATHand parsing the--secretlintignore=<value>form.--secretlintignorefile no longer silently falls back to.secretlintignoreor.gitignore, which would exclude the exact files a secrets scanner must inspect; it degrades with a warning.can_output_sariflinters includingREPOSITORY_SECRETLINT,REPOSITORY_SEMGREP, andREPOSITORY_TRIVY.REPORT_OUTPUT_FOLDERis always excluded from linted directories, even whenEXCLUDED_DIRECTORIESis overridden.