Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Actions: Sequester issue_comment triggered untrusted checkout from other triggers #18838

Open
wants to merge 10 commits into
base: main
Choose a base branch
from
+482 −53
Open

Actions: Sequester issue_comment triggered untrusted checkout from other triggers #18838

Changes from 1 commit
Commits
Show all changes
10 commits
Select commit Hold shift + click to select a range
01afda8
sequester issue_comment triggered untrusted checkout from other triggers
KyFaSt Feb 21, 2025
2368979
remove unused predicate
KyFaSt Feb 21, 2025
3b5d8b5
rename test
KyFaSt Feb 21, 2025
e343646
fix id typos
KyFaSt Feb 21, 2025
67a9c25
Merge branch 'main' into kyfast/untrusted-checkout-refinements
KyFaSt Feb 21, 2025
8ab3ce0
autoformat untrusted checkout query qll
KyFaSt Feb 25, 2025
4a50cce
Merge branch 'kyfast/untrusted-checkout-refinements' of https://githu…
KyFaSt Feb 25, 2025
302b0ed
set security-severity to 0
KyFaSt Feb 27, 2025
aad59c6
linting full stop
KyFaSt Feb 27, 2025
9b1a10a
add change-notes
KyFaSt Feb 28, 2025
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
Prev Previous commit
Next Next commit
linting full stop
  • Loading branch information
@KyFaSt
KyFaSt committed Feb 27, 2025
commit aad59c654d845ac63f21573089eed0caec90527d
2 changes: 1 addition & 1 deletion actions/ql/src/Security/CWE-829/UntrustedCheckoutIssueCommentCritical.ql
View file
Original file line number Diff line number Diff line change
@@ -52,4 +52,4 @@ where
not exists(ControlCheck check | check.protects(checkout, event, "untrusted-checkout")) and
not exists(ControlCheck check | check.protects(poisonable, event, "untrusted-checkout"))
select poisonable, checkout, poisonable,
"Potential execution of untrusted code on a privileged workflow ($@)", event, event.getName()
"Potential execution of untrusted code on a privileged workflow ($@).", event, event.getName()
2 changes: 1 addition & 1 deletion actions/ql/src/Security/CWE-829/UntrustedCheckoutIssueCommentHigh.ql
View file
Original file line number Diff line number Diff line change
@@ -26,5 +26,5 @@ where
inPrivilegedContext(checkout, event) and
event.getName() = issueCommentTriggers() and
not exists(ControlCheck check | check.protects(checkout, event, "untrusted-checkout"))
select checkout, "Potential execution of untrusted code on a privileged workflow ($@)", event,
select checkout, "Potential execution of untrusted code on a privileged workflow ($@).", event,
event.getName()