T09 · Insecure Skill Coding Practices
Warning
- Location
- scripts/workflow-hardening-audit.sh:134
- Finding
- Valid GitHub Actions YAML Syntax Can Bypass Workflow Hardening Checks<![CDATA[ ## Vulnerability Details **File Location**: `scripts/workflow-hardening-audit.sh`, lines 134–135, 167–169, and 199–205 **Vulnerability Type**: Incomplete YAML parsing and security-check bypass **Risk Level**: Medium ### Vulnerable Code ```python job_key_re = re.compile(r"^[A-Za-z0-9_.-]+:\s*(#.*)?$") uses_re = re.compile(r"^\s*(?:-\s*)?uses:\s*([^\s#]+)") ``` ```python if re.match(r'^on\s*:\s*$', line): in_on = True on_indent = indent continue ``` ```python if indent == jobs_indent + 2 and job_key_re.match(stripped): current_job = stripped.split(':', 1)[0] total_jobs += 1 job_timeout[current_job] = False job_permissions[current_job] = False job_concurrency[current_job] = False continue ``` ### Technical Analysis The audit implementation treats GitHub Actions workflow files as line-oriented text and attempts to recognize YAML structures with regular expressions and fixed indentation assumptions. This does not cover all valid YAML representations. The following valid forms can evade or alter the intended checks: 1. **Quoted action references** A step such as: ```yaml - uses: "actions/checkout@main" ``` is matched with the closing quote included in the captured value. The extracted ref becomes `main"` rather than `main`, so `classify_ref()` does not identify it as a branch-like floating reference. 2. **Flow-style or inline event declarations** These valid declarations are not recognized by the parser: ```yaml on: [pull_request_target] ``` ```yaml on: pull_request_target ``` The parser only enters event-processing mode when a line exactly matches `on:`. Consequently, event filters may skip applicable workflows, and the additional risk score for `pull_request_target` is not applied. 3. **Valid non-two-space job indentation** Job discovery requires a job key to be indented exactly two spaces beyond `jobs:`: ```python indent == jobs_indent + 2 ``` YA ...[truncated 2376 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions 1. Replace the regular-expression parser with a maintained YAML parser and inspect the resulting object structure. 2. Account for YAML 1.1 parsers that may interpret the unquoted `on` key as a Boolean value, or select/configure a parser that preserves GitHub Actions semantics. 3. Structurally enumerate every key beneath `jobs` rather than relying on a fixed indentation width. 4. Read `uses` values as decoded YAML scalar values so quoted and unquoted references are classified consistently. 5. Support all valid event declaration forms, including scalar, flow-sequence, and mapping forms: ```yaml on: push on: [push, pull_request_target] on: pull_request_target: ``` 6. Fail closed when a workflow cannot be parsed or has an unexpected structure. A parse failure should not silently produce a lower score. 7. Add regression tests covering: - Single-quoted and double-quoted `uses` values. - Flow-style and scalar `on` declarations. - Two-space, four-space, and other valid indentation widths. - Quoted YAML keys. - Empty and malformed workflows. - Reusable workflows and local action references. - `pull_request_target` combined with mutable action refs. 8. Where practical, require immutable full commit SHA references for third-party actions instead of only flagging a limited set of branch and major-tag names. ]]>