[Safe Outputs Conformance] SEC-005: Cross-repo target-repo field flagged without allowlist check
维护者通常 1 天内回复
还没有人认领这个 Issue。
评估
- 难度
- 2/5
- 预计耗时
- 1-3 小时
- 新手友好度
- 67/100
调研方向
阅读 scripts/check-safe-outputs-conformance.sh，尤其是 check_cross_repo，并检查 actions/setup/js/unified_session_payload.cjs 和 actions/setup/js/unified_session_render.cjs 中的 targetRepo 映射。确认这些文件只传递或显示元数据，然后在映射附近添加文档说明的 SEC-005 豁免。运行 bash scripts/check-safe-outputs-conformance.sh，并确认两个文件都通过。
由索引模型根据 Issue 内容生成。
描述
Conformance Check Failure
Check ID: SEC-005
Severity: HIGH
Category: Security
Problem Description
The conformance checker flags two files for supporting a target-repo-shaped field without a visible allowlist validation call:
actions/setup/js/unified_session_payload.cjs(line ~453): mapstargetRepo/target_repointo the unified session payload field extraction table.actions/setup/js/unified_session_render.cjs(line ~276): includestargetRepoin a list of fields rendered into a human-readable session log line.
Both usages are read-only: they copy an already-resolved targetRepo value from session metadata into an observability payload or log line for display. Neither file makes a GitHub API call against a different repository, so SEC-005s allowlist requirement (allowed.*[Rr]epos, validateTargetRepo, checkAllowedRepo) does not apply to them the way it does to a true cross-repo write handler.
Affected Components
- Files:
actions/setup/js/unified_session_payload.cjs,actions/setup/js/unified_session_render.cjs - Check:
scripts/check-safe-outputs-conformance.shfunctioncheck_cross_repo(SEC-005)
<b>Current vs Expected Behavior</b>
Current Behavior
The SEC-005 regex (\btarget-repo\b|\btargetRepo\b|\btarget_repo\b) matches any file that merely references a targetRepo identifier, including pure display/metadata-mapping code, and then requires an allowlist-check pattern in that same file or logs a HIGH failure.
Expected Behavior
SEC-005 is intended to catch handlers that use target-repo to perform a cross-repository GitHub API write without validating against allowed-repos. Pure metadata pass-through/rendering code that never calls the GitHub API should not trip this check. The script already supports a documented exemption via an @safe-outputs-exempt SEC-005 annotation for exactly this situation.
Remediation Steps
- Confirm
unified_session_payload.cjsandunified_session_render.cjsnever passtargetRepoto an octokit call or any cross-repo write path (only read/display it). - If confirmed, add a documented exemption comment (
// @safe-outputs-exempt SEC-005: <reason>) near the targetRepo field mapping in both files, explaining that the field is display/telemetry-only metadata, not a cross-repo write target. - If either file is later changed to perform an actual cross-repo API call using this field, remove the exemption and add a real allowlist check at that call site instead.
Verification
After remediation, verify the fix by running:
bash scripts/check-safe-outputs-conformance.sh
SEC-005 should report PASS for both files.
References
- Safe Outputs Specification: docs/src/content/docs/specs/safe-outputs-specification.md
- Conformance Checker: scripts/check-safe-outputs-conformance.sh
- Run: §39729823556
- Date: 2026-10-22
Generated by ✅ Daily Safe Outputs Conformance Checker · claude · agent · 132.9 AIC · ⌖ 0.552 AIC · ⊞ 5.4K · ◷
- expires on Oct 22, 2026, 9:54 PM UTC-08:00
- 主要语言
- Go
- 星标
- 5.4k
- 派生
- 596
- 平均合并
- 3 小时 40 分钟
- 30 天内合并 PR
- 830
环境准备
在浏览器里用你自己的 GitHub 账号启动这个项目的开发容器。
- 提供 Dockerfile 或 Docker Compose 文件
- 没有 Pull Request 模板
- 阅读贡献指南
从这里开始
- 先读完整个 Issue，再读项目的贡献指南。
- 在 Issue 下留言说明你要接手 —— 这能避免两个人做同样的事。
- Fork 仓库，在一个分支上完成修改。
- 提交 Pull Request，并在描述里引用这个 Issue 编号。
github/gh-aw 的其他 Issue
-
automation models
难度 1/5 1-3 小时 新手友好度 74/100
维护者通常 1 天内回复
-
agent-research
难度 2/5 1-3 小时 新手友好度 72/100
维护者通常 1 天内回复
-
agentic-workflows
难度 2/5 1-3 小时 新手友好度 72/100
维护者通常 1 天内回复
-
automated conformance good-first-issue safe-outputs
难度 2/5 1-3 小时 新手友好度 70/100
维护者通常 1 天内回复
-
automated conformance safe-outputs
难度 1/5 1 小时以内 新手友好度 78/100
维护者通常 1 天内回复
相似的 Issue
-
难度 2/5 1-3 小时 新手友好度 78/100
-
status:needs-review type:bug
难度 2/5 1-3 小时 新手友好度 78/100
Gentleman-Programming/engram#2079 ·
维护者通常 1 天内回复
-
bug triage/pending
难度 1/5 1 小时以内 新手友好度 66/100
维护者通常 1 天内回复
-
难度 2/5 1-3 小时 新手友好度 77/100
limitlessprojects/Go-Hybrid#1377 ·
维护者通常 1 天内回复
-
bug report
难度 2/5 1-3 小时 新手友好度 76/100
维护者通常 3 天内回复