Skip to content

Commit f4dc86e

Browse files
henrymercerhenrymercer
committed
Correct query metadata for actions/untrusted-checkout/medium 
1 parent 93a4b42 commit f4dc86e

3 files changed

Lines changed: 19 additions & 15 deletions

File tree

‎actions/ql/src/Security/CWE-829/UntrustedCheckoutMedium.ql‎

Lines changed: 5 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -1,8 +1,8 @@
11
/**
2-
* @name Checkout of untrusted code in a trusted context
3-
* @description Privileged workflows have read/write access to the base repository and access to secrets.
4-
* By explicitly checking out and running the build script from a fork the untrusted code is running in an environment
5-
* that is able to push to the base repository and to access secrets.
2+
* @name Checkout of untrusted code in a non-privileged context
3+
* @description Checking out and running the build script from a fork executes untrusted code. Even in a
4+
* non-privileged workflow, this can be abused, for example to compromise self-hosted runners
5+
* or to poison caches and artifacts that are later consumed by privileged workflows.
66
* @kind problem
77
* @problem.severity warning
88
* @precision medium
@@ -20,4 +20,4 @@ from PRHeadCheckoutStep checkout
2020
where
2121
// the checkout occurs in a non-privileged context
2222
inNonPrivilegedContext(checkout)
23-
select checkout, "Potential unsafe checkout of untrusted pull request on privileged workflow."
23+
select checkout, "Potential unsafe checkout of untrusted pull request on non-privileged workflow."

‎actions/ql/src/change-notes/2026-06-04-untrusted-checkout-medium-metadata.md‎

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,4 @@
1+
---
2+
category: queryMetadata
3+
---
4+
* The name, description, and alert message of `actions/untrusted-checkout/medium` have been corrected to describe a non-privileged context.

‎actions/ql/test/query-tests/Security/CWE-829/UntrustedCheckoutMedium.expected‎

Lines changed: 10 additions & 10 deletions
Original file line numberDiff line numberDiff line change
@@ -1,10 +1,10 @@
1-
| .github/workflows/artifactpoisoning81.yml:11:9:14:6 | Uses Step | Potential unsafe checkout of untrusted pull request on privileged workflow. |
2-
| .github/workflows/dependabot2.yml:33:9:38:6 | Uses Step | Potential unsafe checkout of untrusted pull request on privileged workflow. |
3-
| .github/workflows/mend.yml:22:9:29:6 | Uses Step | Potential unsafe checkout of untrusted pull request on privileged workflow. |
4-
| .github/workflows/poc3.yml:18:7:25:4 | Uses Step | Potential unsafe checkout of untrusted pull request on privileged workflow. |
5-
| .github/workflows/poc.yml:30:9:36:6 | Uses Step | Potential unsafe checkout of untrusted pull request on privileged workflow. |
6-
| .github/workflows/priv_pull_request_checkout.yml:14:9:20:6 | Uses Step | Potential unsafe checkout of untrusted pull request on privileged workflow. |
7-
| .github/workflows/test3.yml:28:9:33:6 | Uses Step | Potential unsafe checkout of untrusted pull request on privileged workflow. |
8-
| .github/workflows/test4.yml:18:7:25:4 | Uses Step | Potential unsafe checkout of untrusted pull request on privileged workflow. |
9-
| .github/workflows/test8.yml:20:9:26:6 | Uses Step | Potential unsafe checkout of untrusted pull request on privileged workflow. |
10-
| .github/workflows/test9.yml:11:9:16:6 | Uses Step | Potential unsafe checkout of untrusted pull request on privileged workflow. |
1+
| .github/workflows/artifactpoisoning81.yml:11:9:14:6 | Uses Step | Potential unsafe checkout of untrusted pull request on non-privileged workflow. |
2+
| .github/workflows/dependabot2.yml:33:9:38:6 | Uses Step | Potential unsafe checkout of untrusted pull request on non-privileged workflow. |
3+
| .github/workflows/mend.yml:22:9:29:6 | Uses Step | Potential unsafe checkout of untrusted pull request on non-privileged workflow. |
4+
| .github/workflows/poc3.yml:18:7:25:4 | Uses Step | Potential unsafe checkout of untrusted pull request on non-privileged workflow. |
5+
| .github/workflows/poc.yml:30:9:36:6 | Uses Step | Potential unsafe checkout of untrusted pull request on non-privileged workflow. |
6+
| .github/workflows/priv_pull_request_checkout.yml:14:9:20:6 | Uses Step | Potential unsafe checkout of untrusted pull request on non-privileged workflow. |
7+
| .github/workflows/test3.yml:28:9:33:6 | Uses Step | Potential unsafe checkout of untrusted pull request on non-privileged workflow. |
8+
| .github/workflows/test4.yml:18:7:25:4 | Uses Step | Potential unsafe checkout of untrusted pull request on non-privileged workflow. |
9+
| .github/workflows/test8.yml:20:9:26:6 | Uses Step | Potential unsafe checkout of untrusted pull request on non-privileged workflow. |
10+
| .github/workflows/test9.yml:11:9:16:6 | Uses Step | Potential unsafe checkout of untrusted pull request on non-privileged workflow. |

0 commit comments

Comments
 (0)