Feature Request: checking for Untrusted input

[azu]

Keeping your GitHub Actions and workflows secure: Untrusted input | GitHub Security Lab describe the Untrusted input on GitHub Actions.

In many case, using next values in run: or script: directry has vulnerbility.

github.event.issue.title
github.event.issue.body
github.event.pull_request.title
github.event.pull_request.body
github.event.comment.body
github.event.review.body
github.event.review_comment.body
github.event.pages.*.page_name
github.event.commits.*.message
github.event.head_commit.message
github.event.head_commit.author.email
github.event.head_commit.author.name
github.event.commits.*.author.email
github.event.commits.*.author.name
github.event.pull_request.head.ref
github.event.pull_request.head.label
github.event.pull_request.head.repo.default_branch
github.head_ref

For example, following action has a comand injection vulnerbility.

name: test
on: [pull_request]
permissions:
  contents: read
jobs:
  test:
    name: "Test"
    runs-on: ubuntu-18.04
    steps:
      - name: Checkout
        uses: actions/checkout@v2
      - run: echo "${{ github.event.pull_request.title }}"

If attacker create malcious PR title like ";cat .git/config|base64", GitHub Actions will execulte the title as command.

📝 actions/checkout set GITHUB_TOKEN in .git/config for checkouting repo.

We can mitigate the vulnerbility of action by usging env: as parameter.

name: test
on: [pull_request]
permissions:
  contents: read
jobs:
  test:
    name: "Test"
    runs-on: ubuntu-18.04
    steps:
      - name: Checkout
        uses: actions/checkout@v2
      - run: echo "${PR_TITLE}"
        env:
          PR_TITLE: "${{ github.event.pull_request.title }}"

If actionlint check the Untrusted input in run:, it make us safer.

Related

• GitHub Capture the Flag results | The GitHub Blog
• Security hardening for GitHub Actions - GitHub Docs
• PyPIにおける潜在的な任意コード実行 - RyotaK's Blog

GitHub CodeQL has implemented related functions.

• codeql/ExpressionInjection.ql at main · github/codeql
• codeql/UntrustedCheckout.ql at main · github/codeql

[rhysd]

Thank you for your suggestion. It makes sense to me and looks nice to have. Let me consider this on next minor version up.

[rhysd]

I've implemented this on untrusted-input branch. Remaining task is adding tests and documents. This feature is being included in next minor version up v1.6.0.

[rhysd]

This feature was released at v1.6.0.

[azu]

Thanks! Awesome!