Skip to content

Documentation Actions EnvironmentCheck #6

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
anurag6569201 wants to merge 1 commit into
base: qa/agent-github-codeql/pr-06-22454/base
Choose a base branch
from
Open

Documentation Actions EnvironmentCheck #6

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
12 changes: 11 additions & 1 deletion actions/ql/lib/codeql/actions/security/ControlChecks.qll
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -276,9 +276,19 @@ abstract class LabelCheck extends ControlCheck {
}
}

/**

@shipwright-agent shipwright-agent Bot Sep 12, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Shipwright · HIGH

The documentation says 'populate the predicate 'enabledDeploymentEnvironmentDataModel' to contain a single empty string' to describe 'no acceptable sanitizer environment', but the

Impact: The documentation says 'populate the predicate 'enabledDeploymentEnvironmentDataModel' to contain a single empty string' to describe 'no acceptable sanitizer environment', but the code does not handle an empty string specially. If the predicate contains '""', then 'enabledDeploymentEnvironmentDataModel(this.(Environment).getName())' will only match environments whose name is the empty string — which is almost certai…

Suggested fix: Review the cited evidence, fix the risk if confirmed, and rerun Shipwright.

* A deployment environment that may serve as a sanitizer for
* various vulnerabilities.
*
* It is possible to customize which deployment environments apply. The default behavior

@shipwright-agent shipwright-agent Bot Sep 12, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Shipwright · HIGH

The sanitizer logic silently changes behavior when 'enabledDeploymentEnvironmentDataModel' is populated.

Impact: The sanitizer logic silently changes behavior when 'enabledDeploymentEnvironmentDataModel' is populated. If a user adds a single custom tuple (e.g., 'production'), every other environment — including 'staging', 'dev', or any environment previously considered safe — immediately stops being a sanitizer. This is a global semantic flip triggered by partial configuration, which can cause existing queries to start flaggin…

Suggested fix: Review the cited evidence, fix the risk if confirmed, and rerun Shipwright.

* of this model is for any environment to be considered a sanitizer.
* If values are provided then those names

@shipwright-agent shipwright-agent Bot Sep 12, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Shipwright · HIGH

Treating 'any environment' as a sanitizer by default is a permissive security posture.

Impact: Treating 'any environment' as a sanitizer by default is a permissive security posture. If a deployment environment name is attacker-influenced (e.g., derived from a branch name, PR label, or user-controlled workflow input), an attacker could cause their code to run in an environment that is silently treated as sanitized, suppressing vulnerability findings. The default 'else this instanceof Environment' means every e…

Suggested fix: Review the cited evidence, fix the risk if confirmed, and rerun Shipwright.

* will be used to define the valid sanitizer set.
* To describe the situation where there is no acceptable sanitizer environment
* populate the predicate `enabledDeploymentEnvironmentDataModel` to contain a single empty string.
*/
class EnvironmentCheck extends ControlCheck instanceof Environment {
EnvironmentCheck() {
// if there are any custom tuples use those
if enabledDeploymentEnvironmentDataModel(_)
then enabledDeploymentEnvironmentDataModel(this.(Environment).getName())
else this instanceof Environment
Expand Down