Skip to content

Commit 75448f7

Browse files
JarLobJarLob
authored
Merge pull request #29 from GitHubSecurityLab/unknown
Don't put unknown permissions into the generated yaml
2 parents 1b82c26 + aecbc6a commit 75448f7

File tree

4 files changed

+44
-8
lines changed

4 files changed

+44
-8
lines changed

‎advisor/dist/index.js

Lines changed: 13 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -35140,6 +35140,7 @@ async function analyze(name, count, token, owner, repo, branch) {
3514035140
});
3514135141

3514235142
let permissions = new Map();
35143+
let wasUnknown = false;
3514335144

3514435145
for (const run of runs.data.workflow_runs) {
3514535146
debug(`Analyzing run ${run.id}...`);
@@ -35209,6 +35210,11 @@ async function analyze(name, count, token, owner, repo, branch) {
3520935210

3521035211
const p = permissions.get(jobName);
3521135212
for (const [kind, perm] of jobPermissions) {
35213+
if (kind === 'unknown') {
35214+
wasUnknown = true;
35215+
continue;
35216+
}
35217+
3521235218
if (p.has(kind)) {
3521335219
if (perm === "write") {
3521435220
p.set(kind, perm)
@@ -35222,16 +35228,21 @@ async function analyze(name, count, token, owner, repo, branch) {
3522235228
}
3522335229
}
3522435230

35225-
return permissions;
35231+
return [permissions, wasUnknown];
3522635232
}
3522735233

3522835234
async function run(token, name, count, owner, repo, branch, format) {
35229-
const permissions = await analyze(name, count, token, owner, repo, branch);
35235+
const [permissions, wasUnknown] = await analyze(name, count, token, owner, repo, branch);
3523035236

3523135237
let summary = core.summary.addHeading(`Minimal required permissions for ${name}:`);
3523235238
log(`Minimal required permissions for ${name}:`);
3523335239

3523435240
try {
35241+
if (wasUnknown) {
35242+
summary.addRaw("\nAt least one call wasn't recognized. Some permissions are unknown. Check the workflow runs.\n");
35243+
throw new Error("At least one call wasn't recognized. Some permissions are unknown. Check the workflow runs.");
35244+
}
35245+
3523535246
if (permissions.size === 0) {
3523635247
summary = summary.addRaw('No permissions logs were found.');
3523735248
throw new Error('No permissions logs were found.');

‎advisor/index.js

Lines changed: 13 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -21,6 +21,7 @@ async function analyze(name, count, token, owner, repo, branch) {
2121
});
2222

2323
let permissions = new Map();
24+
let wasUnknown = false;
2425

2526
for (const run of runs.data.workflow_runs) {
2627
debug(`Analyzing run ${run.id}...`);
@@ -90,6 +91,11 @@ async function analyze(name, count, token, owner, repo, branch) {
9091

9192
const p = permissions.get(jobName);
9293
for (const [kind, perm] of jobPermissions) {
94+
if (kind === 'unknown') {
95+
wasUnknown = true;
96+
continue;
97+
}
98+
9399
if (p.has(kind)) {
94100
if (perm === "write") {
95101
p.set(kind, perm)
@@ -103,16 +109,21 @@ async function analyze(name, count, token, owner, repo, branch) {
103109
}
104110
}
105111

106-
return permissions;
112+
return [permissions, wasUnknown];
107113
}
108114

109115
async function run(token, name, count, owner, repo, branch, format) {
110-
const permissions = await analyze(name, count, token, owner, repo, branch);
116+
const [permissions, wasUnknown] = await analyze(name, count, token, owner, repo, branch);
111117

112118
let summary = core.summary.addHeading(`Minimal required permissions for ${name}:`);
113119
log(`Minimal required permissions for ${name}:`);
114120

115121
try {
122+
if (wasUnknown) {
123+
summary.addRaw("\nAt least one call wasn't recognized. Some permissions are unknown. Check the workflow runs.\n");
124+
throw new Error("At least one call wasn't recognized. Some permissions are unknown. Check the workflow runs.");
125+
}
126+
116127
if (permissions.size === 0) {
117128
summary = summary.addRaw('No permissions logs were found.');
118129
throw new Error('No permissions logs were found.');

‎monitor/dist/index.js

Lines changed: 9 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -121806,6 +121806,7 @@ async function run() {
121806121806
const results = JSON.parse(`[${data.trim().replace(/\r?\n|\r/g, ',')}]`);
121807121807

121808121808
let permissions = new Map();
121809+
let wasUnknown = false;
121809121810
for (const result of results) {
121810121811
if (!hosts.has(result.host.toLowerCase()))
121811121812
continue;
@@ -121815,7 +121816,9 @@ async function run() {
121815121816
const perm = p[kind];
121816121817

121817121818
if (kind === 'unknown') {
121818-
console.log(`The github token was used to call ${result.method} ${result.host}${result.path} but the permission is unknown. Please report this to the action author.`);
121819+
core.warning(`The github token was used to call ${result.method} ${result.host}${result.path} but the permission is unknown. Please report this to the action author.`);
121820+
wasUnknown = true;
121821+
continue;
121819121822
}
121820121823

121821121824
if (permissions.has(kind)) {
@@ -121838,6 +121841,10 @@ async function run() {
121838121841
}
121839121842
}
121840121843

121844+
if (wasUnknown) {
121845+
summary += "\nAt least one call wasn't recognized. Please check the logs and report this to the action author.";
121846+
}
121847+
121841121848
core.summary
121842121849
.addRaw('#### Minimal required permissions:\n')
121843121850
.addCodeBlock(summary, 'yaml')
@@ -121871,7 +121878,7 @@ async function run() {
121871121878
}
121872121879
})
121873121880
command.stderr.on('data', output => {
121874-
console.log(output.toString())
121881+
core.warning(output.toString())
121875121882
})
121876121883
command.on('exit', code => {
121877121884
if (code !== 0) {

‎monitor/index.js

Lines changed: 9 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -64,6 +64,7 @@ async function run() {
6464
const results = JSON.parse(`[${data.trim().replace(/\r?\n|\r/g, ',')}]`);
6565

6666
let permissions = new Map();
67+
let wasUnknown = false;
6768
for (const result of results) {
6869
if (!hosts.has(result.host.toLowerCase()))
6970
continue;
@@ -73,7 +74,9 @@ async function run() {
7374
const perm = p[kind];
7475

7576
if (kind === 'unknown') {
76-
console.log(`The github token was used to call ${result.method} ${result.host}${result.path} but the permission is unknown. Please report this to the action author.`);
77+
core.warning(`The github token was used to call ${result.method} ${result.host}${result.path} but the permission is unknown. Please report this to the action author.`);
78+
wasUnknown = true;
79+
continue;
7780
}
7881

7982
if (permissions.has(kind)) {
@@ -96,6 +99,10 @@ async function run() {
9699
}
97100
}
98101

102+
if (wasUnknown) {
103+
summary += "\nAt least one call wasn't recognized. Please check the logs and report this to the action author.";
104+
}
105+
99106
core.summary
100107
.addRaw('#### Minimal required permissions:\n')
101108
.addCodeBlock(summary, 'yaml')
@@ -129,7 +136,7 @@ async function run() {
129136
}
130137
})
131138
command.stderr.on('data', output => {
132-
console.log(output.toString())
139+
core.warning(output.toString())
133140
})
134141
command.on('exit', code => {
135142
if (code !== 0) {

0 commit comments

Comments
 (0)