fix(gha): run-shell-injection flags the truthiness-check shape on bare inputs - #4020
Open
munzzyy wants to merge 1 commit into
Open
fix(gha): run-shell-injection flags the truthiness-check shape on bare inputs#4020munzzyy wants to merge 1 commit into
munzzyy wants to merge 1 commit into
Conversation
…e inputs
Every dangerous source in this rule has a pattern-not exempting the
${{ X && 'literal' }} shape, where X is only checked for truthiness and
never interpolated. There are 35 such sources and 34 of those exemptions;
inputs is the one that never got it. So ${{ inputs.foo && 'yes' }} is
still flagged even though it's the same safe shape as
${{ github.head_ref && 'yes' }} right next to it.
Added the missing pattern-not plus an ok: test case. A bare
${{ inputs.foo }} interpolation still fires, as it should.
Signed-off-by: Cole Munz <colemunz@gmail.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
The
run-shell-injectionrule exempts the truthiness-check shape${{ X && 'literal' }}from every dangerous source, sinceXis only evaluated for truthiness and never interpolated into the shell. There are 35 sources in thepattern-eitherlist and 34 matchingpattern-notexemptions. The one source that never got its exemption isinputs.So
${{ inputs.foo && 'yes' }}still gets flagged, even though it's the exact same safe shape as${{ github.head_ref && 'yes' }}a few lines up, which is correctly exempted.Added the missing
pattern-not: ${{ ... inputs ... && ... }}soinputsmatches the other 34, and anok:test case for it. A bare${{ inputs.foo }}interpolation still fires, so this only drops the false positive on the truthiness shape, not any real detection.Verification
I checked the rule structure directly: the
pattern-eitherlist has 35 sources, the truthinesspattern-notlist has 34, andinputsis the only source with no matching entry. The added pattern mirrors the existing siblings exactly (${{ ... <source> ... && ... }}).Added a paired
ok:case inrun-shell-injection.test.yaml(echo "${{ inputs.message_to_print && 'yes' }}"), alongside the existingruleid:case for the bare interpolation, which stays flagged.