Actions cache-poisoning query ignores workflow/job cache-mode

Aperta
  • Qualcosa non va?
#23,006 0 commenti 0 reazioni 0 assegnatari Vedi su GitHub

I maintainer di solito rispondono entro 1 giorno

Nessuno ha ancora preso questa issue.

Valutazione

Difficoltà
4/5
Tempo stimato
3-5 giorni
Idoneità per principianti
47/100
Tipo di issue
Bug
Chiarezza
Specificata chiaramente
Stato di attività
Attiva
Stack tecnologico
github-actions, yaml
Ambito
security, testing-qa

Direzione di ricerca

Start with actions/ql/lib/codeql/actions/security/CachePoisoningQuery.qll at the referenced cache-write predicate, then run the supplied CodeQL CLI analysis against the four cache-mode variants to confirm the reported behavior. Trace how workflow and job cache policies are modeled, including the reusable-workflow cases identified in the issue. Done means read-only cases produce no finding while the default and job-write controls still do.

Scritto dal modello di indicizzazione a partire dal testo della issue.

Descrizione

Actions cache-poisoning query ignores workflow/job cache-mode

Description of the false positive

actions/cache-poisoning/poisonable-step reports the same finding whether a job
has read-only or writable cache authority. GitHub documents cache-mode: read
as backend-enforced through scoped cache tokens, preventing cache saves.

I reproduced this with CodeQL CLI 2.27.4, codeql/actions-queries 0.6.39,
and codeql/actions-all 0.7.1 from the checksum-verified Linux bundle.
The query pack's build SHA is
1be292a1e54696ca543b4ad0f9b4537b9687caa7.

Code samples

This is synthetic source. It was extracted and analyzed locally; no workflow,
checkout, or npm command was executed.

name: Cache-mode reproduction
on:
  workflow_dispatch:
    inputs:
      source_sha:
        description: Commit to inspect
        required: true
        type: string
permissions:
  contents: read
cache-mode: read
jobs:
  build:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1
        with:
          ref: ${{ inputs.source_sha }}
      - run: npm ci

Four separate source roots differed only in their cache policy:

Variant Workflow cache-mode Job cache-mode Expected findings Observed findings
read read absent 0 1
default absent absent 1 1
job-read absent read 0 1
job-write read write 1 1

The write-capable cases are positive controls, assuming the query's threat
model for manually supplied source. A fix must account for job overrides,
rather than suppress every workflow that contains a read-only declaration.

Each result reports:

Potential cache poisoning in the context of the default branch due to
privilege checkout of untrusted code from inputs.source_sha.
(workflow_dispatch).

Commands

Run these for each variant, using separate database and output paths:

codeql database create db-read \
  --language=actions --build-mode=none --source-root=fixtures/read
codeql database analyze db-read \
  'codeql/[email protected]:Security/CWE-349/CachePoisoningViaPoisonableStep.ql' \
  --threads=2 --ram=4096 --format=sarif-latest --output=read.sarif
jq '[.runs[].results[]? |
  select(.ruleId == "actions/cache-poisoning/poisonable-step")] | length' \
  read.sarif

Relevant model and platform contract

The cache-write predicate considers the triggering event, but does not inspect
explicit workflow/job cache policy:

https://github.com/github/codeql/blob/1be292a1e54696ca543b4ad0f9b4537b9687caa7/actions/ql/lib/codeql/actions/security/CachePoisoningQuery.qll#L45-L64

GitHub's documented policy:

https://docs.github.com/en/actions/reference/workflows-and-actions/dependency-caching#controlling-cache-access-with-cache-mode

https://docs.github.com/en/actions/reference/workflows-and-actions/workflow-syntax#jobsjob_idcache-mode

Reusable-workflow caller limits/inheritance should also be covered by a model
fix, but those cases were not included in this minimal executed reproduction.
This report verifies static query behavior; it does not independently test
cache-token enforcement in the backend.

Authored by GitHub Copilot (GPT-6.1 Sol).

Lingua principale
CodeQL
Stelle
10.3k
Fork
2.1k
Merge medio
2g 6h
PR unite (30g)
137

Preparare l'ambiente

Apri in Codespaces

Avvia il container di sviluppo del progetto nel browser, con il tuo account GitHub.

Come iniziare

  1. Leggi tutta la issue e poi la guida ai contributi del progetto.
  2. Commenta sulla issue per dire che te ne occupi tu — evita che due persone facciano lo stesso lavoro.
  3. Fai un fork del repository e lavora su un branch.
  4. Apri una pull request che faccia riferimento al numero della issue.

Altre issue di github/codeql

Tutte le issue di github/codeql

Issue simili

Altre issue su Security

Ricevi le nuove issue nella tua casella

Un breve riepilogo di issue GitHub adatte ai principianti.