Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

docs: Rename "unsecure" to insecure #270

Merged
merged 2 commits into from
Dec 10, 2024
Merged

docs: Rename "unsecure" to insecure #270

Show file tree
Hide file tree
Changes from 1 commit
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
851ebec
Rename "unsecure" to insecure
szepeviktor Dec 10, 2024
8ffcad2
Revert GitHub's own misspelling
szepeviktor Dec 10, 2024
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
4 changes: 2 additions & 2 deletions docs/audits.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -634,7 +634,7 @@ Workflow commands (like `::set-env` and `::add-path`)
to inject environment variables and therefore obtain code execution).

However, users can explicitly re-enable them by setting the
`ACTIONS_ALLOW_UNSECURE_COMMANDS` environment variable at the workflow,
`ACTIONS_ALLOW_INSECURE_COMMANDS` environment variable at the workflow,
Copy link
Owner

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

We can't change the environment variable anywhere, only the other uses of "unsecure" -- the envvar is GitHub's own misspelling, which we need to detect.

(Sorry, I didn't notice this in your search earlier.)

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Okay!

Done 🍏

We have 1×unsecure, I've added some "GitHub"-s.

Copy link
Owner

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Thanks!

job, or step level.

Other resources:
Expand All @@ -653,7 +653,7 @@ In general, users should use for [Github Actions environment files]
run: |
echo "::add-path::$HOME/.local/my-bin"
env:
ACTIONS_ALLOW_UNSECURE_COMMANDS: true
ACTIONS_ALLOW_INSECURE_COMMANDS: true
```

=== "After"
Expand Down
4 changes: 2 additions & 2 deletions src/audit/insecure_commands.rs
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -31,7 +31,7 @@ impl InsecureCommands {
.persona(Persona::Auditor)
.add_location(
location.with_keys(&["env".into()]).annotated(
"non-static environment may contain ACTIONS_ALLOW_UNSECURE_COMMANDS",
"non-static environment may contain ACTIONS_ALLOW_INSECURE_COMMANDS",
),
)
.build(workflow)
Expand All @@ -54,7 +54,7 @@ impl InsecureCommands {
}

fn has_insecure_commands_enabled(&self, env: &Env) -> bool {
if let Some(EnvValue::String(value)) = env.get("ACTIONS_ALLOW_UNSECURE_COMMANDS") {
if let Some(EnvValue::String(value)) = env.get("ACTIONS_ALLOW_INSECURE_COMMANDS") {
!value.is_empty()
} else {
false
Expand Down
4 changes: 2 additions & 2 deletions tests/acceptance.rs
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -210,7 +210,7 @@ fn audit_unpinned_uses() -> anyhow::Result<()> {
}

#[test]
fn audit_unsecure_commands_allowed() -> anyhow::Result<()> {
fn audit_insecure_commands_allowed() -> anyhow::Result<()> {
let auditable = workflow_under_test("insecure-commands.yml");

let cli_args = [&auditable];
Expand All @@ -225,7 +225,7 @@ fn audit_unsecure_commands_allowed() -> anyhow::Result<()> {
assert_value_match(
&findings,
"$[0].locations[0].concrete.feature",
"ACTIONS_ALLOW_UNSECURE_COMMANDS",
"ACTIONS_ALLOW_INSECURE_COMMANDS",
);

Ok(())
Expand Down
2 changes: 1 addition & 1 deletion tests/snapshots/snapshot__insecure_commands-2.snap
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -8,7 +8,7 @@ error[insecure-commands]: execution of insecure workflow commands is enabled
|
8 | env:
| _____^
9 | | ACTIONS_ALLOW_UNSECURE_COMMANDS: yes
9 | | ACTIONS_ALLOW_INSECURE_COMMANDS: yes
| |__________________________________________^ insecure commands enabled here
|
= note: audit confidence → High
Expand Down
4 changes: 2 additions & 2 deletions tests/snapshots/snapshot__insecure_commands.snap
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -8,7 +8,7 @@ error[insecure-commands]: execution of insecure workflow commands is enabled
|
8 | env:
| _____^
9 | | ACTIONS_ALLOW_UNSECURE_COMMANDS: yes
9 | | ACTIONS_ALLOW_INSECURE_COMMANDS: yes
| |__________________________________________^ insecure commands enabled here
|
= note: audit confidence → High
Expand All @@ -17,7 +17,7 @@ error[insecure-commands]: execution of insecure workflow commands is enabled
--> @@INPUT@@:22:9
|
22 | env: ${{ matrix.env }}
| ^^^^^^^^^^^^^^^^^^^^^^ non-static environment may contain ACTIONS_ALLOW_UNSECURE_COMMANDS
| ^^^^^^^^^^^^^^^^^^^^^^ non-static environment may contain ACTIONS_ALLOW_INSECURE_COMMANDS
|
= note: audit confidence → Low

Expand Down
2 changes: 1 addition & 1 deletion tests/test-data/inlined-ignores.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -13,7 +13,7 @@ jobs:
insecure-commands-ignored:
runs-on: ubuntu-latest
env:
ACTIONS_ALLOW_UNSECURE_COMMANDS: yes # zizmor: ignore[insecure-commands]
ACTIONS_ALLOW_INSECURE_COMMANDS: yes # zizmor: ignore[insecure-commands]
steps:
- run: echo "I shall pass!"

Expand Down
4 changes: 2 additions & 2 deletions tests/test-data/insecure-commands.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -6,7 +6,7 @@ jobs:
some-dangerous-job:
runs-on: ubuntu-latest
env:
ACTIONS_ALLOW_UNSECURE_COMMANDS: yes
ACTIONS_ALLOW_INSECURE_COMMANDS: yes
steps:
- run: echo "don't do this"

Expand All @@ -15,7 +15,7 @@ jobs:
strategy:
matrix:
env:
- ACTIONS_ALLOW_UNSECURE_COMMANDS: yes
- ACTIONS_ALLOW_INSECURE_COMMANDS: yes

steps:
- run: echo "don't do this"
Expand Down