Actions cache-poisoning query ignores workflow/job cache-mode

Abierto
  • ¿Algo no está bien?
#23,006 0 comentarios 0 reacciones 0 asignados Ver en GitHub

Los mantenedores suelen responder en 1 día

Nadie ha tomado este issue todavía.

Evaluación

Dificultad
4/5
Tiempo estimado
3-5 días
Aptitud para principiantes
47/100
Tipo de issue
Error
Claridad
Bien especificado
Estado de actividad
Activo
Stack tecnológico
github-actions, yaml
Área
security, testing-qa

Línea de trabajo

Start with actions/ql/lib/codeql/actions/security/CachePoisoningQuery.qll at the referenced cache-write predicate, then run the supplied CodeQL CLI analysis against the four cache-mode variants to confirm the reported behavior. Trace how workflow and job cache policies are modeled, including the reusable-workflow cases identified in the issue. Done means read-only cases produce no finding while the default and job-write controls still do.

Escrito por el modelo de indexación a partir del texto del issue.

Descripción

Actions cache-poisoning query ignores workflow/job cache-mode

Description of the false positive

actions/cache-poisoning/poisonable-step reports the same finding whether a job
has read-only or writable cache authority. GitHub documents cache-mode: read
as backend-enforced through scoped cache tokens, preventing cache saves.

I reproduced this with CodeQL CLI 2.27.4, codeql/actions-queries 0.6.39,
and codeql/actions-all 0.7.1 from the checksum-verified Linux bundle.
The query pack's build SHA is
1be292a1e54696ca543b4ad0f9b4537b9687caa7.

Code samples

This is synthetic source. It was extracted and analyzed locally; no workflow,
checkout, or npm command was executed.

name: Cache-mode reproduction
on:
  workflow_dispatch:
    inputs:
      source_sha:
        description: Commit to inspect
        required: true
        type: string
permissions:
  contents: read
cache-mode: read
jobs:
  build:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1
        with:
          ref: ${{ inputs.source_sha }}
      - run: npm ci

Four separate source roots differed only in their cache policy:

Variant Workflow cache-mode Job cache-mode Expected findings Observed findings
read read absent 0 1
default absent absent 1 1
job-read absent read 0 1
job-write read write 1 1

The write-capable cases are positive controls, assuming the query's threat
model for manually supplied source. A fix must account for job overrides,
rather than suppress every workflow that contains a read-only declaration.

Each result reports:

Potential cache poisoning in the context of the default branch due to
privilege checkout of untrusted code from inputs.source_sha.
(workflow_dispatch).

Commands

Run these for each variant, using separate database and output paths:

codeql database create db-read \
  --language=actions --build-mode=none --source-root=fixtures/read
codeql database analyze db-read \
  'codeql/[email protected]:Security/CWE-349/CachePoisoningViaPoisonableStep.ql' \
  --threads=2 --ram=4096 --format=sarif-latest --output=read.sarif
jq '[.runs[].results[]? |
  select(.ruleId == "actions/cache-poisoning/poisonable-step")] | length' \
  read.sarif

Relevant model and platform contract

The cache-write predicate considers the triggering event, but does not inspect
explicit workflow/job cache policy:

https://github.com/github/codeql/blob/1be292a1e54696ca543b4ad0f9b4537b9687caa7/actions/ql/lib/codeql/actions/security/CachePoisoningQuery.qll#L45-L64

GitHub's documented policy:

https://docs.github.com/en/actions/reference/workflows-and-actions/dependency-caching#controlling-cache-access-with-cache-mode

https://docs.github.com/en/actions/reference/workflows-and-actions/workflow-syntax#jobsjob_idcache-mode

Reusable-workflow caller limits/inheritance should also be covered by a model
fix, but those cases were not included in this minimal executed reproduction.
This report verifies static query behavior; it does not independently test
cache-token enforcement in the backend.

Authored by GitHub Copilot (GPT-6.1 Sol).

Lenguaje dominante
CodeQL
Estrellas
10.3k
Forks
2.1k
Merge medio
2 d 6 h
PR fusionados (30 d)
137

Preparar el entorno

Abrir en Codespaces

Inicia el contenedor de desarrollo del proyecto en tu navegador, con tu propia cuenta de GitHub.

Primeros pasos

  1. Lee el issue completo y luego la guía de contribución del proyecto.
  2. Comenta en el issue que vas a ocuparte — evita que dos personas hagan lo mismo.
  3. Haz un fork del repositorio y trabaja en una rama.
  4. Abre un pull request que haga referencia al número del issue.

Más de github/codeql

Todos los issues de github/codeql

Issues similares

Más issues de Security

Recibe los nuevos issues en tu correo

Un resumen breve de issues de GitHub para principiantes.