T09 · Insecure Skill Coding Practices
Error
- Location
scripts/daily-ops.js:119- Finding
Fail-Open Dependabot Validation Can Merge Unverified or High-Risk Changes
- Content
View full analysis
r.conclusion === 'success' || r.conclusion === 'skipped' || r.status === 'in_progress'); return { passing }; } ``` ```javascript if (opts.mergeDependabot && info.dependabotPRs.length > 0) { for (const pr of info.dependabotPRs) { const severity = getSeverityFromTitle(pr.title); if (severity === 'HIGH') { console.log(` ⛔ Skip HIGH CVE PR #${pr.number}: ${pr.title} (human review required)`); totalSkipped++; continue; } const { passing } = await getPRChecks(token, org, repo, pr); if (!passing) { console.log(` ⏳ Skip PR #${pr.number}: CI not passing yet`); totalSkipped++; continue; } console.log(` 🔀 Merging PR #${pr.number}: ${pr.title}`); const merged = await mergePR(token, org, repo, pr); ``` ### Technical Analysis The documented policy states that only LOW or MEDIUM severity Dependabot pull requests with passing CI are eligible for automatic merging. The implementation fails open in several ways: 1. A pull request with no check runs is considered passing. 2. A check run with `status === 'in_progress'` is considered passing, regardless of its eventual conclusion. 3. Severity values classified as `UNKNOWN` are eligible for merging because only `HIGH` is explicitly rejected. 4. Severity is inferred from untrusted pull-request title text in ...[truncated 1484 chars]- Remediation
View remediation