Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Actions: Sequester issue_comment triggered untrusted checkout from other triggers #18838

Open
wants to merge 10 commits into
base: main
Choose a base branch
from
+482 −53
Open

Actions: Sequester issue_comment triggered untrusted checkout from other triggers #18838

Changes from 1 commit
Commits
Show all changes
10 commits
Select commit Hold shift + click to select a range
01afda8
sequester issue_comment triggered untrusted checkout from other triggers
KyFaSt Feb 21, 2025
2368979
remove unused predicate
KyFaSt Feb 21, 2025
3b5d8b5
rename test
KyFaSt Feb 21, 2025
e343646
fix id typos
KyFaSt Feb 21, 2025
67a9c25
Merge branch 'main' into kyfast/untrusted-checkout-refinements
KyFaSt Feb 21, 2025
8ab3ce0
autoformat untrusted checkout query qll
KyFaSt Feb 25, 2025
4a50cce
Merge branch 'kyfast/untrusted-checkout-refinements' of https://githu…
KyFaSt Feb 25, 2025
302b0ed
set security-severity to 0
KyFaSt Feb 27, 2025
aad59c6
linting full stop
KyFaSt Feb 27, 2025
9b1a10a
add change-notes
KyFaSt Feb 28, 2025
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
Prev Previous commit
add change-notes
  • Loading branch information
@KyFaSt
KyFaSt committed Feb 28, 2025
commit 9b1a10a782d591c6f98714164cc8d3833926f85a
5 changes: 5 additions & 0 deletions actions/ql/src/change-notes/released/0.6.0.md
View file
Original file line number Diff line number Diff line change
@@ -0,0 +1,5 @@
## 0.6.0

### Major Analysis Improvements

* Moved the trigger `issueComment` in the actions/untrusted-checkout-high (CWE-829) and actions/untrusted-checkout-critical (CWE-829) queries to separate queries (actions/untrusted-checkout-issue-comment-high and actions/untrusted-checkout-issue-comment-critical) because while they are vulnerable to the same attack, they do not have the same resolution. Further work is needed to make this trigger safer to use.
Loading
Oops, something went wrong.