T08 · Insecure Dependencies
Warning
- Location
references/10-testing.md:7- Finding
Unpinned Third-Party Testing and CI Dependencies
- Content
View full analysis
search "GDUnit4" > download > install 2. Project > Project Settings > Plugins > enable "GDUnit4" ``` It then instructs users to execute scripts supplied by that dependency: ```bash # Run all tests godot --headless -s addons/gdunit4/bin/GdUnitCmdTool.gd --add test/ # Run a specific file godot --headless -s addons/gdunit4/bin/GdUnitCmdTool.gd --add test/player/test_player.gd # Verbose output godot --headless -s addons/gdunit4/bin/GdUnitCmdTool.gd --add test/ -v ``` The suggested CI workflow also uses a mutable container tag and GitHub Actions references pinned only to major-version tags: ```yaml # .github/workflows/tests.yml name: Tests on: [push, pull_request] jobs: test: runs-on: ubuntu-latest container: image: barichello/godot-ci:4.2 steps: - uses: actions/checkout@v4 - name: Run tests run: | godot --headless -s addons/gdunit4/bin/GdUnitCmdTool.gd \ --add test/ \ --report-directory reports/ - name: Upload results uses: actions/upload-artifact@v3 with: name: test-results path: reports/ ``` ### Technical Analysis The installation instructions identify GDUnit4 only through an AssetLib search. They do not authenticate the package publisher or pin an audited release. This creates exposure to lookalike packages, account compromise, or a malicious future release. The subsequent `godot -s` commands directly execute the installed dependency's GDScript code with the permissions of th ...[truncated 2292 chars]- Remediation
View remediation
``` - Obtain the digest from a trusted registry and review it before upgrades. 4. **Pin GitHub Actions to full commit SHAs** - Replace major-version tags with reviewed commit identifiers: ```yaml - uses: actions/checkout@ - uses: actions/upload-artifact@ ``` - Keep a comment beside each SHA documenting the corresponding release version. 5. **Apply least-privilege CI permissions** - Declare restrictive workflow permissions explicitly: ```yaml permissions: contents: read ``` - Grant additional permissions only to jobs that demonstrably require them. - Do not expose deployment credentials or unrelated repository secrets to test jobs. - Avoid making secrets available to workflows that execute untrusted pull-request code. 6. **Constrain execution** - Run tests in an isolated, ephemeral environment. - Restrict filesystem mounts and outbound network access where practical. - Separate testing from signing, publishing, and deployment jobs. - Review installed add-on scripts before invoking `godot -s`. ]]>