Script injection through user controlled values
ID: github-actions/script-injection
Language: YAML
Severity: Warning
Category: Security
Description
As detailed in Security hardening for GitHub Actions - GitHub Docs, it is possible for an attacker to inject scripts through PR, branch, commit names, and more.
Avoid using user input in your actions shell scripts, and if you must, consider storing them first in an environment variable to escape them properly.
Read Cycode Discovers a Supply Chain Vulnerability in Bazel - Cycode if you wanna see a concrete exploitation of such mechanism.
Non-Compliant Code Examples
jobs:
build-and-publish:
runs-on: ubuntu-latest
steps:
- name: Echo PR title
run: |
title="${{ github.event.pull_request.title }}"
echo $title
Compliant Code Examples
permissions:
contents: read
jobs:
build-and-publish:
runs-on: ubuntu-latest
steps:
- name: Echo PR title
env:
TITLE: ${{ github.event.pull_request.title }}
run: |
echo $TITLE
- name: Echo runner tytle
run: |
echo "${{ runner.name }}"
Seamless integrations. Try Datadog Code Analysis
