Documentation Actions EnvironmentCheck - #6
anurag6569201 wants to merge 1 commit into
Conversation
Source PR: github#22454 Source head: f82774b
✅ Shipwright · ApproveRecommendation: approve PR #6 · Tier
Findings (3)
Fireworks usage: 5,303 input · 520 output · 5,823 total tokens · $0.0015 · 9s · 0 fix iteration(s) Open the Shipwright check for full evidence and the audit bundle. Use |
![shipwright-agent[bot]](https://avatars.githubusercontent.com/u/140162738?s=60&v=4){kind=small}
| } | ||
| } | ||
|
|
||
| /** |
There was a problem hiding this comment.
Shipwright · HIGH
The documentation says 'populate the predicate 'enabledDeploymentEnvironmentDataModel' to contain a single empty string' to describe 'no acceptable sanitizer environment', but the
Impact: The documentation says 'populate the predicate 'enabledDeploymentEnvironmentDataModel' to contain a single empty string' to describe 'no acceptable sanitizer environment', but the code does not handle an empty string specially. If the predicate contains '""', then 'enabledDeploymentEnvironmentDataModel(this.(Environment).getName())' will only match environments whose name is the empty string — which is almost certai…
Suggested fix: Review the cited evidence, fix the risk if confirmed, and rerun Shipwright.
| * A deployment environment that may serve as a sanitizer for | ||
| * various vulnerabilities. | ||
| * | ||
| * It is possible to customize which deployment environments apply. The default behavior |
There was a problem hiding this comment.
Shipwright · HIGH
The sanitizer logic silently changes behavior when 'enabledDeploymentEnvironmentDataModel' is populated.
Impact: The sanitizer logic silently changes behavior when 'enabledDeploymentEnvironmentDataModel' is populated. If a user adds a single custom tuple (e.g., 'production'), every other environment — including 'staging', 'dev', or any environment previously considered safe — immediately stops being a sanitizer. This is a global semantic flip triggered by partial configuration, which can cause existing queries to start flaggin…
Suggested fix: Review the cited evidence, fix the risk if confirmed, and rerun Shipwright.
| * | ||
| * It is possible to customize which deployment environments apply. The default behavior | ||
| * of this model is for any environment to be considered a sanitizer. | ||
| * If values are provided then those names |
There was a problem hiding this comment.
Shipwright · HIGH
Treating 'any environment' as a sanitizer by default is a permissive security posture.
Impact: Treating 'any environment' as a sanitizer by default is a permissive security posture. If a deployment environment name is attacker-influenced (e.g., derived from a branch name, PR label, or user-controlled workflow input), an attacker could cause their code to run in an environment that is silently treated as sanitized, suppressing vulnerability findings. The default 'else this instanceof Environment' means every e…
Suggested fix: Review the cited evidence, fix the risk if confirmed, and rerun Shipwright.
1 participant
Improve documentation on actions/security/ControlChecks.qll EnvironmentCheck
currently was undocumented and as such its intended ways to use it could stand to be clarified
I dont think this needs a change note... but let me know if that is an incorrect assumption
Source merge-base:
9567f1a22fceaf9f9124e5b4adef879a8aef058eSource head:
f82774b69b0a25d7eb9765f4980c1c19b2905e92