T05 · Unauthorized Access and Privilege Escalation
Error
- Location
config/policies.yaml:39- Finding
Production Workspaces Can Apply Database Migrations Despite the Documented Prohibition
- Content
View full analysis
ActionResult: result = resolve_stack(ws, self._config, self._executor).apply_migration_local(ws) return ActionResult(result.succeeded, "apply_migration_local", ws.id, output=result.stdout, error=result.stderr) ``` ```python # stacks/dotnet/efcore.py:167-175 def apply_migration_local(self, ws: "WorkspaceConfig") -> ExecutionResult: if not ws.test_db_connection: return ExecutionResult( stderr="拒绝执行：workspace 未配置 test_db_connection（测试库连接串）。" "为避免误连生产库，本动作必须显式提供测试库连接。", exit_code=2, ) return self._executor.execute(commands.database_update(ws), cwd=ws.repo_path, timeout=600) ``` ### Technical Analysis The documented policy states that applying a migration from a production workspace must be prohibited. However, the `prod` policy does not add `apply_migration_local` to `forbidden_extra`. Consequently, the default confirmation-required rule remains effective in production, and the operation executes after confirmation. The runtime safeguard only verifies that `test_db_connection` is nonempty. The field name is treated as proof of the target environment, but no validation establishes that the connection points to a test database. A production connection string can therefore be assigned to this field and used by `dotnet ef database update`. The `inherits: default` keys also have no explicit processing in `PolicyEngine._resolve_policy`; inheritanc ...[truncated 1186 chars]- Remediation
View remediation