Skip to content

Solution (#3915): Dangerous Workflow: some user input are not being detected as unt - #5147

Open
TFGSUMIT wants to merge 1 commit into
ossf:mainfrom
TFGSUMIT:fix/issue-3915
Open

Solution (#3915): Dangerous Workflow: some user input are not being detected as unt#5147
TFGSUMIT wants to merge 1 commit into
ossf:mainfrom
TFGSUMIT:fix/issue-3915

Conversation

@TFGSUMIT

Copy link
Copy Markdown

This PR addresses the issue of untrusted user input not being detected in the contains_untrusted_context_pattern function. The function now correctly identifies variables containing untrusted context patterns, such as GitHub event context details that may be attacker-controlled.

Changes made:

  • Updated the contains_untrusted_context_pattern function to include additional GitHub event context details that may be attacker-controlled.
  • Added new test cases to cover these scenarios.
  • Updated the test cases to cover the new scenarios.

Testing instructions:

  • Run the test cases using python -m unittest checks.dangerous_workflow_test.
  • Verify that the function correctly identifies variables containing untrusted context patterns.
  • Verify that the function returns False for variables not containing untrusted context patterns.

@TFGSUMIT
TFGSUMIT requested a review from a team as a code owner July 28, 2026 11:08
@TFGSUMIT
TFGSUMIT requested review from AdamKorcz and spencerschrock and removed request for a team July 28, 2026 11:08
@dosubot dosubot Bot added the size:M This PR changes 30-99 lines, ignoring generated files. label Jul 28, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

size:M This PR changes 30-99 lines, ignoring generated files.

Projects

Status: No status

Development

Successfully merging this pull request may close these issues.

1 participant