Repository navigation
[code-scanning-fix] Fix ai-scan/cwe-78: extract Actions expressions from shell comments in run steps - #74855
Closed
github-actions[bot] wants to merge 1 commit into
Closed
[code-scanning-fix] Fix ai-scan/cwe-78: extract Actions expressions from shell comments in run steps#74855github-actions[bot] wants to merge 1 commit into
github-actions[bot] wants to merge 1 commit into
Conversation
Contributor
There was a problem hiding this comment.
🟡 Changes recommended
Critical sanitizer bypasses still allow comment-based newline injection into lock files, and existing test expectations contradict the new behavior.
2 open issues
What changed in this PR
This PR hardens gh-aw’s run-step sanitizer against shell injection through GitHub Actions expressions embedded in shell comments.
Changes:
- Extracts comment expressions into environment bindings and replaces them with generated variable references.
- Uses consistent quoted-heredoc boundaries for scanning and replacement, leaving quoted bodies unchanged.
| File | Description |
|---|---|
pkg/workflow/run_step_sanitizer.go |
Includes shell comments in expression extraction and replacement while preserving quoted heredoc bodies. |
Review effort: Max (auto)
| // protection: a value containing a newline escapes the comment. Only | ||
| // quoted heredoc bodies are left in place (rewriting them would emit the | ||
| // literal variable name); validation is responsible for those. | ||
| scanContent := transformShellContent(runVal, func(s string) string { return s }, true, false) |
| // protection: a value containing a newline escapes the comment. Only | ||
| // quoted heredoc bodies are left in place (rewriting them would emit the | ||
| // literal variable name); validation is responsible for those. | ||
| scanContent := transformShellContent(runVal, func(s string) string { return s }, true, false) |
Collaborator
|
@copilot run pr-finisher skill |
Collaborator
|
Duplicate of #74793 |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Security Fix: Shell injection through expressions in shell comments
Alert Number: #1060
Severity: High
Rule: ai-scan/cwe-78
CWE: CWE-78
Vulnerability Description
The run-step sanitizer only extracted
${{ }}expressions from content it considered executable, so expressions inside#comments stayed inline. GitHub Actions expands expressions before the shell runs. A value with a newline (such as an issue title) can end the comment and inject commands.Location
Fix Applied
env:and replaced with$GH_AW_*references.Security Best Practices
Bind untrusted data through
env:instead of inlining template expressions in shell scripts.Testing Considerations
The sandbox did not allow running
go testhere, so CI must validate this change. Please rungo test ./pkg/workflow/ -run 'Sanitiz|Heredoc|TemplateInjection|RunStep'. Some existing assertions may expect comments to be left untouched and may need updating. Follow-up: the template-injection validator still permits expressions in quoted heredoc bodies. Consider rejecting those too.Automated by: Code Scanning Fixer Workflow
Run ID: 41833342676