Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Actions: Sequester issue_comment triggered untrusted checkout from other triggers #18838

Open
wants to merge 10 commits into
base: main
Choose a base branch
from
+482 −53
Open

Actions: Sequester issue_comment triggered untrusted checkout from other triggers #18838

Changes from 3 commits
Commits
Show all changes
10 commits
Select commit Hold shift + click to select a range
01afda8
sequester issue_comment triggered untrusted checkout from other triggers
KyFaSt Feb 21, 2025
2368979
remove unused predicate
KyFaSt Feb 21, 2025
3b5d8b5
rename test
KyFaSt Feb 21, 2025
e343646
fix id typos
KyFaSt Feb 21, 2025
67a9c25
Merge branch 'main' into kyfast/untrusted-checkout-refinements
KyFaSt Feb 21, 2025
8ab3ce0
autoformat untrusted checkout query qll
KyFaSt Feb 25, 2025
4a50cce
Merge branch 'kyfast/untrusted-checkout-refinements' of https://githu…
KyFaSt Feb 25, 2025
302b0ed
set security-severity to 0
KyFaSt Feb 27, 2025
aad59c6
linting full stop
KyFaSt Feb 27, 2025
9b1a10a
add change-notes
KyFaSt Feb 28, 2025
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
4 changes: 2 additions & 2 deletions actions/ql/src/Security/CWE-829/UntrustedCheckoutIssueCommentCritical.ql
View file
Original file line number Diff line number Diff line change
@@ -6,7 +6,7 @@
* @kind path-problem
* @problem.severity warning
* @precision high
* @security-severity 7.5
* @security-severity 0.0
Copy link
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I think we'll want to avoid this. We can discuss internally. Do we have known CVEs involving this problem, that we can use to compute the severity based on CVSS?

* @id actions/untrusted-checkout-issue-comment/critical
* @tags actions
* security
@@ -52,4 +52,4 @@ where
not exists(ControlCheck check | check.protects(checkout, event, "untrusted-checkout")) and
not exists(ControlCheck check | check.protects(poisonable, event, "untrusted-checkout"))
select poisonable, checkout, poisonable,
"Potential execution of untrusted code on a privileged workflow ($@)", event, event.getName()
"Potential execution of untrusted code on a privileged workflow ($@).", event, event.getName()
4 changes: 2 additions & 2 deletions actions/ql/src/Security/CWE-829/UntrustedCheckoutIssueCommentHigh.ql
View file
Original file line number Diff line number Diff line change
@@ -6,7 +6,7 @@
* @kind problem
* @problem.severity warning
* @precision high
* @security-severity 7.5
* @security-severity 0.0
* @id actions/untrusted-checkout-issue-comment/high
* @tags actions
* security
@@ -26,5 +26,5 @@ where
inPrivilegedContext(checkout, event) and
event.getName() = issueCommentTriggers() and
not exists(ControlCheck check | check.protects(checkout, event, "untrusted-checkout"))
select checkout, "Potential execution of untrusted code on a privileged workflow ($@)", event,
select checkout, "Potential execution of untrusted code on a privileged workflow ($@).", event,
event.getName()
5 changes: 5 additions & 0 deletions actions/ql/src/change-notes/released/0.6.0.md
View file
Original file line number Diff line number Diff line change
@@ -0,0 +1,5 @@
## 0.6.0

### Major Analysis Improvements

* Moved the trigger `issueComment` in the actions/untrusted-checkout-high (CWE-829) and actions/untrusted-checkout-critical (CWE-829) queries to separate queries (actions/untrusted-checkout-issue-comment-high and actions/untrusted-checkout-issue-comment-critical) because while they are vulnerable to the same attack, they do not have the same resolution. Further work is needed to make this trigger safer to use.
Loading
Oops, something went wrong.