Skip to content

Commit 0e3097d

Browse files
author
Alvaro Muñoz
authored
Merge pull request #79 from github/secrets-in-artifacts
feat: New query to report GITHUB_TOKEN exposed in artifacts
2 parents b2f6ef2 + 25eb417 commit 0e3097d

File tree

4 files changed

+115
-0
lines changed

4 files changed

+115
-0
lines changed

‎ql/src/Security/CWE-312/SecretsInArtifacts.ql

Lines changed: 45 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,45 @@
1+
/**
2+
* @name Secret In Artifacts
3+
* @description Secrets are exposed in GitHub Artifacts
4+
* @kind problem
5+
* @problem.severity error
6+
* @security-severity 9.0
7+
* @precision high
8+
* @id actions/secrets-in-artifacts
9+
* @tags actions
10+
* security
11+
* external/cwe/cwe-312
12+
*/
13+
14+
import actions
15+
16+
from UsesStep checkout, UsesStep upload
17+
where
18+
checkout.getCallee() = "actions/checkout" and
19+
upload.getCallee() = "actions/upload-artifact" and
20+
checkout.getAFollowingStep() = upload and
21+
(
22+
not exists(checkout.getArgument("persist-credentials")) or
23+
checkout.getArgument("persist-credentials") = "true"
24+
) and
25+
upload.getVersion() =
26+
[
27+
"v4.3.6", "834a144ee995460fba8ed112a2fc961b36a5ec5a", //
28+
"v4.3.5", "89ef406dd8d7e03cfd12d9e0a4a378f454709029", //
29+
"v4.3.4", "0b2256b8c012f0828dc542b3febcab082c67f72b", //
30+
"v4.3.3", "65462800fd760344b1a7b4382951275a0abb4808", //
31+
"v4.3.2", "1746f4ab65b179e0ea60a494b83293b640dd5bba", //
32+
"v4.3.1", "5d5d22a31266ced268874388b861e4b58bb5c2f3", //
33+
"v4.3.0", "26f96dfa697d77e81fd5907df203aa23a56210a8", //
34+
"v4.2.0", "694cdabd8bdb0f10b2cea11669e1bf5453eed0a6", //
35+
"v4.1.0", "1eb3cb2b3e0f29609092a73eb033bb759a334595", //
36+
"v4.0.0", "c7d193f32edcb7bfad88892161225aeda64e9392", //
37+
] and
38+
(
39+
not exists(checkout.getArgument("path")) and
40+
upload.getArgument("path") = [".", "*"]
41+
or
42+
checkout.getArgument("path") + ["", "/*"] = upload.getArgument("path")
43+
)
44+
select upload, "A secret is exposed in an artifact uploaded by $@", upload,
45+
"actions/upload-artifact"

‎ql/test/query-tests/Security/CWE-312/.github/workflows/secrets-in-artifacts.yml

Lines changed: 64 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,64 @@
1+
name: secrets-in-artifacts
2+
on:
3+
pull_request:
4+
jobs:
5+
test1: # VULNERABLE
6+
runs-on: ubuntu-latest
7+
steps:
8+
- uses: actions/checkout@v4
9+
- name: "Upload artifact"
10+
uses: actions/upload-artifact@1746f4ab65b179e0ea60a494b83293b640dd5bba # v4.3.2
11+
with:
12+
name: file
13+
path: .
14+
test2: # NOT VULNERABLE
15+
runs-on: ubuntu-latest
16+
steps:
17+
- uses: actions/checkout@v4
18+
- name: "Upload artifact"
19+
uses: actions/upload-artifact@v4
20+
with:
21+
name: file
22+
path: .
23+
test3: # VULNERABLE
24+
runs-on: ubuntu-latest
25+
steps:
26+
- uses: actions/checkout@v4
27+
- name: "Upload artifact"
28+
uses: actions/upload-artifact@1746f4ab65b179e0ea60a494b83293b640dd5bba # v4.3.2
29+
with:
30+
name: file
31+
path: "*"
32+
test4: # VULNERABLE
33+
runs-on: ubuntu-latest
34+
steps:
35+
- uses: actions/checkout@v4
36+
with:
37+
path: foo
38+
- name: "Upload artifact"
39+
uses: actions/upload-artifact@1746f4ab65b179e0ea60a494b83293b640dd5bba # v4.3.2
40+
with:
41+
name: file
42+
path: foo
43+
test5: # VULNERABLE
44+
runs-on: ubuntu-latest
45+
steps:
46+
- uses: actions/checkout@v4
47+
with:
48+
path: foo
49+
- name: "Upload artifact"
50+
uses: actions/upload-artifact@1746f4ab65b179e0ea60a494b83293b640dd5bba # v4.3.2
51+
with:
52+
name: file
53+
path: foo/*
54+
test6: # NOT VULNERABLE
55+
runs-on: ubuntu-latest
56+
steps:
57+
- uses: actions/checkout@v4
58+
with:
59+
path: pr
60+
- name: "Upload artifact"
61+
uses: actions/upload-artifact@1746f4ab65b179e0ea60a494b83293b640dd5bba # v4.3.2
62+
with:
63+
name: file
64+
path: foo

‎ql/test/query-tests/Security/CWE-312/SecretsInArtifacts.expected

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,4 @@
1+
| .github/workflows/secrets-in-artifacts.yml:9:9:14:2 | Uses Step | A secret is exposed in a public artifact uploaded by $@ | .github/workflows/secrets-in-artifacts.yml:9:9:14:2 | Uses Step | actions/upload-artifact |
2+
| .github/workflows/secrets-in-artifacts.yml:27:9:32:2 | Uses Step | A secret is exposed in a public artifact uploaded by $@ | .github/workflows/secrets-in-artifacts.yml:27:9:32:2 | Uses Step | actions/upload-artifact |
3+
| .github/workflows/secrets-in-artifacts.yml:38:9:43:2 | Uses Step | A secret is exposed in a public artifact uploaded by $@ | .github/workflows/secrets-in-artifacts.yml:38:9:43:2 | Uses Step | actions/upload-artifact |
4+
| .github/workflows/secrets-in-artifacts.yml:49:9:54:2 | Uses Step | A secret is exposed in a public artifact uploaded by $@ | .github/workflows/secrets-in-artifacts.yml:49:9:54:2 | Uses Step | actions/upload-artifact |

‎ql/test/query-tests/Security/CWE-312/SecretsInArtifacts.qlref

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,2 @@
1+
Security/CWE-312/SecretsInArtifacts.ql
2+

0 commit comments

Comments
 (0)