T09 · Insecure Skill Coding Practices
Warning
- Location
scripts/gitlab_ci_linter.py:125- Finding
Unsupported YAML Constructs Are Silently Omitted, Causing Security Audit Bypass
- Content
View full analysis
expected_indent: self.pos += 1 continue stripped = self._strip_comment(line).strip() if stripped.startswith('- '): break # list context if ':' not in stripped: self.pos += 1 continue ``` The parser is invoked without checking whether it consumed and understood all security-relevant input: ```python def parse_yaml(text): parser = YAMLParser(text) return parser.parse() ``` ### Technical Analysis The project uses a custom, partial YAML parser for GitLab CI configuration. In `_parse_mapping`, lines with unexpected indentation or unsupported structure are silently skipped rather than causing a parsing error. The parser also does not implement important YAML features commonly accepted in GitLab CI, including anchors, aliases, merge keys, and tags. The `parse_yaml` wrapper returns the resulting partial mapping without verifying that every meaningful token or line was consumed. Security rules subsequently operate on this incomplete representation and can therefore reach incorrect conclusions. A concrete bypass can use a YAML merge key to inherit a security-sensitive property: ```yaml .security-defaults: &security-defaults allow_failure: true security_scan: <<: *security-defaults script: - run-security-scan ``` GitLab's YAML processing ca ...[truncated 1899 chars]- Remediation
View remediation