Skip to content

Commit adabd2d

Browse files
authored
Update pedantic persona example (#1714)
Signed-off-by: William Woodruff <william@yossarian.net>
1 parent 04d270c commit adabd2d

File tree

1 file changed

+12
-8
lines changed

1 file changed

+12
-8
lines changed

docs/usage.md

Lines changed: 12 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -501,22 +501,26 @@ sensitive `zizmor`'s analyses are:
501501
security decision by the workflow/action author).
502502

503503
For example, using the pedantic persona will flag the following
504-
with an `unpinned-uses` finding, since it uses a symbolic reference
505-
as its pin instead of a hashed pin:
504+
with a `template-injection` finding, since it uses a template
505+
expansion in a `#!yaml run:` block, even though the expansion
506+
itself is not attacker-controllable:
506507

507508
```yaml
508-
uses: actions/checkout@v3
509+
run: |
510+
echo "running with ${{ github.event_name }}"
509511
```
510512
511513
produces:
512514
513515
```console
514-
$ zizmor --pedantic tests/test-data/unpinned-uses.yml
515-
help[unpinned-uses]: unpinned action reference
516-
--> tests/test-data/unpinned-uses.yml:14:9
516+
$ zizmor --pedantic example.yml
517+
help[template-injection]: code injection via template expansion
518+
--> crates/zizmor/tests/integration/test-data/neutral.yml:22:34
517519
|
518-
14 | - uses: actions/checkout@v3
519-
| ------------------------- help: action is not pinned to a hash ref
520+
21 | - run: |
521+
| --- this run block
522+
22 | echo "running with ${{ github.event_name }}"
523+
| ^^^^^^^^^^^^^^^^^ may expand into attacker-controllable code
520524
|
521525
= note: audit confidence → High
522526
```

0 commit comments

Comments
 (0)