Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

csv-lint & json-lint: Use printf %q to sanatize input and avoid command injection #196

Merged
merged 1 commit into from
Dec 14, 2023
Merged

csv-lint & json-lint: Use printf %q to sanatize input and avoid command injection #196

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
5 changes: 3 additions & 2 deletions .github/workflows/csv-lint.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -40,6 +40,7 @@ jobs:
run: |
cd csvlint
for file in ${{ steps.changed-files.outputs.all_changed_files }}; do
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Is 42 subject to injection?

Did you asses env laundering as a potential mitigation? See the discussion in the "Remediation" section here:

https://securitylab.github.com/research/github-actions-untrusted-input/

env:
    FILES: ${{ steps.changed-files.outputs.all_changed_files }}
run:
  for file in $FILES; ...

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Is 42 subject to injection?

I don't believe so. My understanding is that bash has a strict interpenetration of the input parameter for a for loop. Similar to how command injection should not be possible with FOO=${{ steps.changed-files.outputs.all_changed_files }}

Related since we are discussing it, I considered also setting the IFS to correctly handle filenames with spaces. But setting this value would actually make a theoretically command injection easier (though in theory not possible given the printf change).

Let me know if you have any opinion on if I should make that change.

Did you asses env laundering as a potential mitigation?

As I understand it the printf would still be necessary. Once the for loop logic breaks apart the input I think injection may still be possible. Do you think it's worth adding this protection given the above? I have no concerns, just trying to keep complexity to a minimum.

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

@wadells friendly ping on this when you have a chance. Not high priority, but it would be nice to finish this NCC finding out.

Copy link
Contributor

@wadells wadells Dec 14, 2023 •
edited
Loading

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Sorry -- you hadn't requested re-review, so this wasn't showing up in my review queue:

image

The best way to make sure I (or most other folks) revisit something (especially if I've requested changes) is to re-request review. Otherwise, if I get pulled away from the initial @ notification (for whatever reason), it'll never show back up in my queue.

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Thank you, requested. To be clear I have not made any changes yet, I am just looking for feedback on if we want to additionally add the environment filter.

echo "Validating ${file}"
go run cmd/csvlint/main.go ../${file}
sanitized_file=$(printf '%q' "$file")
echo "Validating ${sanitized_file}"
go run cmd/csvlint/main.go ../${sanitized_file}
done
5 changes: 3 additions & 2 deletions .github/workflows/json-lint.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -28,6 +28,7 @@ jobs:
if: steps.changed-files.outputs.any_changed == 'true'
run: |
for file in ${{ steps.changed-files.outputs.all_changed_files }}; do
echo "Validating ${file}"
jq empty ${file}
sanitized_file=$(printf '%q' "$file")
echo "Validating ${sanitized_file}"
jq empty ${sanitized_file}
done
Loading