T09 · Insecure Skill Coding Practices
Warning
- Location
- scripts/oidc-hardening-audit.sh:102
- Finding
- Workflow-Wide Regex Checks Can Miss Insecure Job-Level OIDC Configurations## Vulnerability Details **File Location**: `scripts/oidc-hardening-audit.sh`, lines 102–103, 139–140, and 165–176 **Vulnerability Type**: Incorrect security validation caused by unscoped text matching **Risk Level**: Medium **Vulnerable code:** ```python perm_id_token_write_re = re.compile(r"^\s*id-token\s*:\s*write\s*(?:#.*)?$", re.IGNORECASE | re.MULTILINE) role_to_assume_re = re.compile(r"^\s*role-to-assume\s*:\s*[^\s#]+") ``` ```python lines = text.splitlines() has_id_token_write = bool(perm_id_token_write_re.search(text)) auth_actions = [] floating_refs = [] aws_action_lines = set() aws_role_to_assume_present = False aws_static_input_present = False secret_cloud_key_lines = [] ``` ```python if not has_id_token_write: score += 4 issues.append({ 'code': 'missing_id_token_write', 'message': 'Workflow uses cloud auth action(s) but does not declare id-token: write permissions.', 'weight': 4, }) if any(action['provider'] == 'aws' for action in auth_actions): if not aws_role_to_assume_present: score += 2 issues.append({ 'code': 'aws_role_to_assume_missing', 'message': 'AWS auth action is present but role-to-assume is missing (OIDC federation likely incomplete).', 'weight': 2, }) ``` ### Technical Analysis The scanner analyzes each workflow as unstructured text rather than parsing its YAML hierarchy. The `has_id_token_write` and `aws_role_to_assume_present` variables therefore represent whether matching text appears anywhere in the file, not whether the setting applies to the job or authentication step being audited. GitHub Actions supports workflow-level and job-level permissions. A job-level `permissions` block can override workflow-level permissions. Consequently, an `id-token: write` declaration in one job, or at workflow level when overridden by the cloud-authentication jo ...[truncated 1851 chars]
- Remediation
- ## Remediation Suggestions 1. Replace regex-based workflow interpretation with structural YAML parsing through a safe loader. 2. Analyze every `jobs.<job_id>` object independently and associate each cloud authentication action with its containing job and exact step. 3. Resolve effective permissions according to GitHub Actions semantics: - Read workflow-level permissions. - Apply job-level permission overrides. - Verify that the specific cloud-authentication job has effective `id-token: write`. 4. Inspect `role-to-assume`, static credential inputs, and provider-specific options only within the `with` mapping of the corresponding authentication step. 5. Do not count matching strings found in comments, shell commands, environment values, or YAML block scalars as configuration. 6. Add regression tests covering multiple jobs, job-level permission overrides, unrelated `role-to-assume` fields, YAML block scalars, and multiple AWS authentication steps with different configurations. 7. Fail safely or emit an explicit parse error when a workflow cannot be structurally parsed, rather than deriving security conclusions from partial text matches.