Repository navigation
Potential fix for code scanning alert no. 40: Checkout of untrusted code in a non-privileged context - #2319
Potential fix for code scanning alert no. 40: Checkout of untrusted code in a non-privileged context#2319don-petry wants to merge 5 commits into
Conversation
…ode in a non-privileged context Copilot Autofix Co-authored-by: Copilot Autofix powered by AI <62310815+github-advanced-security[bot]@users.noreply.github.com>
This comment has been minimized.
This comment has been minimized.
This comment has been minimized.
This comment has been minimized.
![github-advanced-security[bot]](https://avatars.githubusercontent.com/in/57789?s=60&v=4){kind=small}
Dev-Lead — review-changes (applied)Changes committed and pushed. Requested items addressed:
|
|
|
No description provided. |
|
No description provided. |
This comment has been minimized.
This comment has been minimized.
Dev-Lead — fix-bot-comment (no-changes)Agent reasoning |
|
No description provided. |
|
This is an operational notice — the bot is unable to generate a review due to unsupported file types. All CI checks pass; there are no code issues to address. |
Dev-Lead — fix-bot-comment (no-changes)Agent reasoning |
| echo "::error::inputs.agent_ref contains unsafe characters: $ref" | ||
| exit 1 | ||
| fi | ||
| if [[ ! "$ref" =~ ^[A-Za-z0-9._/-]+$ ]]; then |
There was a problem hiding this comment.
[High] The character-class check ^[A-Za-z0-9._/-]+$ (combined with only blocking ^refs/pull/ and 40-char hex SHAs) still allows untrusted refs: actions/checkout resolves shorthand PR refs (pull/<n>/head, pull/<n>/merge), abbreviated commit SHAs (7–39 hex chars), and arbitrary unmerged branch names, all of which match ^[A-Za-z0-9._/-]+$. In addition, writing $ref to $GITHUB_ENV on line 278 triggers a new CodeQL Environment variable built from user-controlled sources alert, and the second Checkout dev-lead scripts step in the downstream job remains unvalidated. Validate $ref against an explicit allowlist of valid dev-lead channel/release refs (^main$|^dev-lead/(v[0-9]+(\.[0-9]+\.[0-9]+|-(stable|next|ring[0-9]+))|stable|next|ring[0-9]+)$) and pass it via $GITHUB_OUTPUT (steps.<id>.outputs.ref) in both jobs.
CI Failure: CodeQLStep: CodeQL code scanning (alert: "Environment variable built from user-controlled sources", CodeQL reported 1 new medium-severity alert in the workflow YAML. A step validates Suggested fix: In |
|
No description provided. |
Dev-Lead-Stamp: 2d4ab034be5cb16d84635fa1d760b8a9b6e77d73
Dev-Lead Fix CI — appliedPR: #2319 | SHA: |
|
No description provided. |
|
No description provided. |
|
This PR is not in draft mode — it's ready for merge. The notice about draft PRs is informational only and requires no code changes. |
Dev-Lead — fix-bot-comment (no-changes)Agent reasoning |
|
Potential fix for https://github.com/petry-projects/.github-private/security/code-scanning/40
Best fix: validate and constrain
inputs.agent_refbefore checkout, and fail closed on unsafe values. This keeps existing functionality (still allows intended pinned channels/branches/tags) while preventing PR refs/SHAs/paths that could be attacker-controlled in untrusted contexts.In
.github/workflows/dev-lead-reusable.yml, add a new step immediately before “Checkout dev-lead scripts” that:inputs.agent_refwith fallback tomain.refs/pull/*, raw 40-hex SHAs, traversal characters, whitespace, or other non-safe characters.SAFE_AGENT_REF) into$GITHUB_ENV.Then change the checkout step’s
reffrom${{ inputs.agent_ref }}to${{ env.SAFE_AGENT_REF }}.No new dependencies are needed; shell validation is sufficient.
Suggested fixes powered by Copilot Autofix. Review carefully before merging.
Problem
See the linked issue.
Risk
Medium — changes GitHub Actions workflow behavior, which is exercised only post-merge; verify via the affected workflow runs.
Test plan
No test files were added or updated. Verification:
bash scripts/dev-lead-lint.sh(shellcheck --severity=warning) ran pre-commit; the existing CI (bats + lint) guards the change.Rollback
Revert this PR. No non-revertible side effects (no tags, migrations, or external state).
Monitoring
Watch the affected workflow run(s) in the Actions tab and this PR's Lint check for regressions.