File tree Expand file tree Collapse file tree 1 file changed +12
-8
lines changed
Expand file tree Collapse file tree 1 file changed +12
-8
lines changed Original file line number Diff line number Diff line change @@ -501,22 +501,26 @@ sensitive `zizmor`'s analyses are:
501501 security decision by the workflow/action author).
502502
503503 For example, using the pedantic persona will flag the following
504- with an ` unpinned-uses ` finding, since it uses a symbolic reference
505- as its pin instead of a hashed pin:
504+ with a ` template-injection ` finding, since it uses a template
505+ expansion in a ` #!yaml run: ` block, even though the expansion
506+ itself is not attacker-controllable:
506507
507508 ``` yaml
508- uses : actions/checkout@v3
509+ run : |
510+ echo "running with ${{ github.event_name }}"
509511 ` ` `
510512
511513 produces:
512514
513515 ` ` ` console
514- $ zizmor --pedantic tests/test-data/unpinned-uses .yml
515- help[unpinned-uses ] : unpinned action reference
516- --> tests/test-data/unpinned-uses .yml:14:9
516+ $ zizmor --pedantic example .yml
517+ help[template-injection ] : code injection via template expansion
518+ --> crates/zizmor/ tests/integration/ test-data/neutral .yml:22:34
517519 |
518- 14 | - uses : actions/checkout@v3
519- | ------------------------- help : action is not pinned to a hash ref
520+ 21 | - run : |
521+ | --- this run block
522+ 22 | echo "running with ${{ github.event_name }}"
523+ | ^^^^^^^^^^^^^^^^^ may expand into attacker-controllable code
520524 |
521525 = note : audit confidence → High
522526 ` ` `
You can’t perform that action at this time.
0 commit comments