False positive in CWE-829 /UntrustedCheckoutMedium.ql
Nobody has claimed this yet.
Assessment
- Difficulty
- 3/5
- Estimated time
- 1-2 days
- Newbie friendliness
- 55/100
Research direction
Start with the CWE-829 /UntrustedCheckoutMedium.ql query and review the triggered and called workflow examples linked in the report. Compare the query result with the pull_request-triggered workflow behavior and the linked code-scanning alert. Done means the called workflow is no longer incorrectly reported as privileged.
Written by the indexing model from the issue text.
Description
Description of the false positive
When there is a workflow that is triggered by a pull_request, this check considers the called workflow to be privileged even though it is not.
Code samples or links to source code
Triggered Workflow: https://raw.githubusercontent.com/llvm/llvm-project/refs/heads/main/.github/workflows/release-binaries-all.yml
Called Workflow: https://raw.githubusercontent.com/llvm/llvm-project/refs/heads/main/.github/workflows/release-binaries.yml
URL to the alert on GitHub code scanning (optional)
https://github.com/llvm/llvm-project/security/code-scanning/1828
- Dominant language
- CodeQL
- Stars
- 10.1k
- Forks
- 2.1k
- Avg merge
- 2d 10h
- Merged PRs (30d)
- 134
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
More from github/codeql
-
Difficulty 2/5 1-3 hours Newbie friendliness 84/100
-
C#: cs/simplifiable-boolean-expression false positive on Nullable<bool> compared with a literal Open
Difficulty 2/5 1-3 hours Newbie friendliness 82/100
-
Difficulty 2/5 1-3 hours Newbie friendliness 78/100
-
false-positive
Difficulty 2/5 1-3 hours Newbie friendliness 70/100
-
false-positive
Difficulty 3/5 1-2 days Newbie friendliness 68/100
Similar issues
-
Difficulty 2/5 1-3 hours Newbie friendliness 88/100
NVIDIA/gpu-operator#2955 ·
-
agentic-workflows
Difficulty 2/5 1-3 hours Newbie friendliness 68/100
-
automated issue report
Difficulty 1/5 1-3 hours Newbie friendliness 76/100
-
Difficulty 2/5 1-3 hours Newbie friendliness 82/100
dsx-ai-factory/infra-controller#6694 ·
-
bug build
Difficulty 2/5 1-3 hours Newbie friendliness 88/100
facebookincubator/velox#19143 ·