> ## Documentation Index
> Fetch the complete documentation index at: https://docs.codeant.ai/llms.txt
> Use this file to discover all available pages before exploring further.

# Security

<AccordionGroup>
  <Accordion title="workflow-run-target-code-checkout">
    This GitHub Actions workflow file uses `workflow_run` and checks out code from the incoming pull request. When using `workflow_run`, the Action runs in the context of the target repository, which includes access to all repository secrets. Normally, this is safe because the Action only runs code from the target repository, not the incoming PR. However, by checking out the incoming PR code, you're now using the incoming code for the rest of the action. You may be inadvertently executing arbitrary code from the incoming PR with access to repository secrets, which would let an attacker steal repository secrets. This normally happens by running build scripts (e.g., `npm build` and `make`) or dependency installation scripts (e.g., `python setup.py install`). Audit your workflow file to make sure no code from the incoming PR is executed. Please see [https://securitylab.github.com/research/github-actions-preventing-pwn-requests/](https://securitylab.github.com/research/github-actions-preventing-pwn-requests/) for additional mitigations.<br />**Likelihood**: MEDIUM<br />**Confidence**: MEDIUM<br />**CWE**: <br />- C
    <br />- W
    <br />- E
    <br />- -
    <br />- 9
    <br />- 1
    <br />- 3
    <br />- :
    <br />-\
    <br />- I
    <br />- m
    <br />- p
    <br />- r
    <br />- o
    <br />- p
    <br />- e
    <br />- r
    <br />-\
    <br />- C
    <br />- o
    <br />- n
    <br />- t
    <br />- r
    <br />- o
    <br />- l
    <br />-\
    <br />- o
    <br />- f
    <br />-\
    <br />- D
    <br />- y
    <br />- n
    <br />- a
    <br />- m
    <br />- i
    <br />- c
    <br />- a
    <br />- l
    <br />- l
    <br />- y
    <br />- -
    <br />- M
    <br />- a
    <br />- n
    <br />- a
    <br />- g
    <br />- e
    <br />- d
    <br />-\
    <br />- C
    <br />- o
    <br />- d
    <br />- e
    <br />-\
    <br />- R
    <br />- e
    <br />- s
    <br />- o
    <br />- u
    <br />- r
    <br />- c
    <br />- e
    <br />- s
    <br />**OWASP**: <br />- A
    <br />- 0
    <br />- 1
    <br />- :
    <br />- 2
    <br />- 0
    <br />- 1
    <br />- 7
    <br />-\
    <br />- -
    <br />-\
    <br />- I
    <br />- n
    <br />- j
    <br />- e
    <br />- c
    <br />- t
    <br />- i
    <br />- o
    <br />- n
  </Accordion>

  <Accordion title="pull-request-target-code-checkout">
    This GitHub Actions workflow file uses `pull_request_target` and checks out code from the incoming pull request. When using `pull_request_target`, the Action runs in the context of the target repository, which includes access to all repository secrets. Normally, this is safe because the Action only runs code from the target repository, not the incoming PR. However, by checking out the incoming PR code, you're now using the incoming code for the rest of the action. You may be inadvertently executing arbitrary code from the incoming PR with access to repository secrets, which would let an attacker steal repository secrets. This normally happens by running build scripts (e.g., `npm build` and `make`) or dependency installation scripts (e.g., `python setup.py install`). Audit your workflow file to make sure no code from the incoming PR is executed. Please see [https://securitylab.github.com/research/github-actions-preventing-pwn-requests/](https://securitylab.github.com/research/github-actions-preventing-pwn-requests/) for additional mitigations.<br />**Likelihood**: LOW<br />**Confidence**: LOW<br />**CWE**: <br />- CWE-913: Improper Control of Dynamically-Managed Code Resources
    <br />**OWASP**: <br />- A01:2021 - Broken Access Control
  </Accordion>

  <Accordion title="github-script-injection">
    Using variable interpolation `${{...}}` with `github` context data in a `actions/github-script`'s `script:` step could allow an attacker to inject their own code into the runner. This would allow them to steal secrets and code. `github` context data can have arbitrary user input and should be treated as untrusted. Instead, use an intermediate environment variable with `env:` to store the data and use the environment variable in the `run:` script. Be sure to use double-quotes the environment variable, like this: "\$ENVVAR".<br />**Likelihood**: HIGH<br />**Confidence**: HIGH<br />**CWE**: <br />- CWE-94: Improper Control of Generation of Code ('Code Injection')
    <br />**OWASP**: <br />- A03:2021 - Injection
  </Accordion>

  <Accordion title="third-party-action-not-pinned-to-commit-sha">
    An action sourced from a third-party repository on GitHub is not pinned to a full length commit SHA. Pinning an action to a full length commit SHA is currently the only way to use an action as an immutable release. Pinning to a particular SHA helps mitigate the risk of a bad actor adding a backdoor to the action's repository, as they would need to generate a SHA-1 collision for a valid Git object payload.<br />**Likelihood**: LOW<br />**Confidence**: HIGH<br />**CWE**: <br />- CWE-1357: Reliance on Insufficiently Trustworthy Component
    <br />- CWE-353: Missing Support for Integrity Check
    <br />**OWASP**: <br />- A
    <br />- 0
    <br />- 6
    <br />- :
    <br />- 2
    <br />- 0
    <br />- 2
    <br />- 1
    <br />-\
    <br />- -
    <br />-\
    <br />- V
    <br />- u
    <br />- l
    <br />- n
    <br />- e
    <br />- r
    <br />- a
    <br />- b
    <br />- l
    <br />- e
    <br />-\
    <br />- a
    <br />- n
    <br />- d
    <br />-\
    <br />- O
    <br />- u
    <br />- t
    <br />- d
    <br />- a
    <br />- t
    <br />- e
    <br />- d
    <br />-\
    <br />- C
    <br />- o
    <br />- m
    <br />- p
    <br />- o
    <br />- n
    <br />- e
    <br />- n
    <br />- t
    <br />- s
  </Accordion>

  <Accordion title="allowed-unsecure-commands">
    The environment variable `ACTIONS_ALLOW_UNSECURE_COMMANDS` grants this workflow permissions to use the `set-env` and `add-path` commands. There is a vulnerability in these commands that could result in environment variables being modified by an attacker. Depending on the use of the environment variable, this could enable an attacker to, at worst, modify the system path to run a different command than intended, resulting in arbitrary code execution. This could result in stolen code or secrets. Don't use `ACTIONS_ALLOW_UNSECURE_COMMANDS`. Instead, use Environment Files. See [https://github.com/actions/toolkit/blob/main/docs/commands.md#environment-files](https://github.com/actions/toolkit/blob/main/docs/commands.md#environment-files) for more information.<br />**Likelihood**: LOW<br />**Confidence**: MEDIUM<br />**CWE**: <br />- CWE-749: Exposed Dangerous Method or Function
    <br />**OWASP**: <br />- A
    <br />- 0
    <br />- 6
    <br />- :
    <br />- 2
    <br />- 0
    <br />- 1
    <br />- 7
    <br />-\
    <br />- -
    <br />-\
    <br />- S
    <br />- e
    <br />- c
    <br />- u
    <br />- r
    <br />- i
    <br />- t
    <br />- y
    <br />-\
    <br />- M
    <br />- i
    <br />- s
    <br />- c
    <br />- o
    <br />- n
    <br />- f
    <br />- i
    <br />- g
    <br />- u
    <br />- r
    <br />- a
    <br />- t
    <br />- i
    <br />- o
    <br />- n
  </Accordion>

  <Accordion title="curl-eval">
    Data is being eval'd from a `curl` command. An attacker with control of the server in the `curl` command could inject malicious code into the `eval`, resulting in a system comrpomise. Avoid eval'ing untrusted data if you can. If you must do this, consider checking the SHA sum of the content returned by the server to verify its integrity.<br />**Likelihood**: LOW<br />**Confidence**: LOW<br />**CWE**: <br />- CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
    <br />**OWASP**: <br />- A01:2017 - Injection
    <br />- A03:2021 - Injection
  </Accordion>

  <Accordion title="run-shell-injection">
    Using variable interpolation `${{...}}` with `github` context data in a `run:` step could allow an attacker to inject their own code into the runner. This would allow them to steal secrets and code. `github` context data can have arbitrary user input and should be treated as untrusted. Instead, use an intermediate environment variable with `env:` to store the data and use the environment variable in the `run:` script. Be sure to use double-quotes the environment variable, like this: "\$ENVVAR".<br />**Likelihood**: HIGH<br />**Confidence**: HIGH<br />**CWE**: <br />- CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
    <br />**OWASP**: <br />- A01:2017 - Injection
    <br />- A03:2021 - Injection
  </Accordion>
</AccordionGroup>