Actions cache-poisoning query ignores workflow/job cache-mode

未关闭
  • 哪里不对？
#23,006 0 条评论 0 个 reaction 已指派 0 人 在 GitHub 查看

维护者通常 1 天内回复

还没有人认领这个 Issue。

评估

难度
4/5
预计耗时
3-5 天
新手友好度
47/100
Issue 类型
缺陷
描述清晰度
描述清楚
活跃度
活跃
技术栈
github-actions, yaml
领域
security, testing-qa

调研方向

Start with actions/ql/lib/codeql/actions/security/CachePoisoningQuery.qll at the referenced cache-write predicate, then run the supplied CodeQL CLI analysis against the four cache-mode variants to confirm the reported behavior. Trace how workflow and job cache policies are modeled, including the reusable-workflow cases identified in the issue. Done means read-only cases produce no finding while the default and job-write controls still do.

由索引模型根据 Issue 内容生成。

描述

Actions cache-poisoning query ignores workflow/job cache-mode

Description of the false positive

actions/cache-poisoning/poisonable-step reports the same finding whether a job
has read-only or writable cache authority. GitHub documents cache-mode: read
as backend-enforced through scoped cache tokens, preventing cache saves.

I reproduced this with CodeQL CLI 2.27.4, codeql/actions-queries 0.6.39,
and codeql/actions-all 0.7.1 from the checksum-verified Linux bundle.
The query pack's build SHA is
1be292a1e54696ca543b4ad0f9b4537b9687caa7.

Code samples

This is synthetic source. It was extracted and analyzed locally; no workflow,
checkout, or npm command was executed.

name: Cache-mode reproduction
on:
  workflow_dispatch:
    inputs:
      source_sha:
        description: Commit to inspect
        required: true
        type: string
permissions:
  contents: read
cache-mode: read
jobs:
  build:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1
        with:
          ref: ${{ inputs.source_sha }}
      - run: npm ci

Four separate source roots differed only in their cache policy:

Variant Workflow cache-mode Job cache-mode Expected findings Observed findings
read read absent 0 1
default absent absent 1 1
job-read absent read 0 1
job-write read write 1 1

The write-capable cases are positive controls, assuming the query's threat
model for manually supplied source. A fix must account for job overrides,
rather than suppress every workflow that contains a read-only declaration.

Each result reports:

Potential cache poisoning in the context of the default branch due to
privilege checkout of untrusted code from inputs.source_sha.
(workflow_dispatch).

Commands

Run these for each variant, using separate database and output paths:

codeql database create db-read \
  --language=actions --build-mode=none --source-root=fixtures/read
codeql database analyze db-read \
  'codeql/[email protected]:Security/CWE-349/CachePoisoningViaPoisonableStep.ql' \
  --threads=2 --ram=4096 --format=sarif-latest --output=read.sarif
jq '[.runs[].results[]? |
  select(.ruleId == "actions/cache-poisoning/poisonable-step")] | length' \
  read.sarif

Relevant model and platform contract

The cache-write predicate considers the triggering event, but does not inspect
explicit workflow/job cache policy:

https://github.com/github/codeql/blob/1be292a1e54696ca543b4ad0f9b4537b9687caa7/actions/ql/lib/codeql/actions/security/CachePoisoningQuery.qll#L45-L64

GitHub's documented policy:

https://docs.github.com/en/actions/reference/workflows-and-actions/dependency-caching#controlling-cache-access-with-cache-mode

https://docs.github.com/en/actions/reference/workflows-and-actions/workflow-syntax#jobsjob_idcache-mode

Reusable-workflow caller limits/inheritance should also be covered by a model
fix, but those cases were not included in this minimal executed reproduction.
This report verifies static query behavior; it does not independently test
cache-token enforcement in the backend.

Authored by GitHub Copilot (GPT-6.1 Sol).

主要语言
CodeQL
星标
10.3k
派生
2.1k
平均合并
2 天 6 小时
30 天内合并 PR
137

环境准备

在 Codespaces 中打开

在浏览器里用你自己的 GitHub 账号启动这个项目的开发容器。

  • 没有 Dockerfile 或 Docker Compose 文件
  • 没有 Pull Request 模板
  • 阅读贡献指南

从这里开始

  1. 先读完整个 Issue，再读项目的贡献指南。
  2. 在 Issue 下留言说明你要接手 —— 这能避免两个人做同样的事。
  3. Fork 仓库，在一个分支上完成修改。
  4. 提交 Pull Request，并在描述里引用这个 Issue 编号。

github/codeql 的其他 Issue

查看 github/codeql 的全部 Issue

相似的 Issue

更多 Security Issue

把新 issue 发到你的邮箱

精选适合新手参与的 GitHub issue 摘要。