Script injection through user controlled values Cette page n'est pas encore disponible en français, sa traduction est en cours.
Si vous avez des questions ou des retours sur notre projet de traduction actuel,
n'hésitez pas à nous contacter .
TRY THIS RULE ID: github-actions/script-injection
Language: YAML
Severity: Warning
Category: Security
Description As detailed in Security hardening for GitHub Actions - GitHub Docs , it is possible for an attacker to inject scripts through PR, branch, commit names, and more.
Avoid using user input in your actions shell scripts, and if you must, consider storing them first in an environment variable to escape them properly.
Read Cycode Discovers a Supply Chain Vulnerability in Bazel - Cycode if you wanna see a concrete exploitation of such mechanism.
Non-Compliant Code Examples jobs :
build-and-publish :
runs-on : ubuntu-latest
steps :
- name : Echo PR title
run : |
title="${{ github.event.pull_request.title }}"
echo $title
Compliant Code Examples permissions :
contents : read
jobs :
build-and-publish :
runs-on : ubuntu-latest
steps :
- name : Echo PR title
env :
TITLE : ${{ github.event.pull_request.title }}
run : |
echo $TITLE
- name : Echo runner tytle
run : |
echo "${{ runner.name }}"
Seamless integrations. Try Datadog Code Analysis
