I pointed my own security tool at my own GitHub Action. It found two bugs.

Описание и применение

Внутренний тест инструмента SecHelix выявил две ошибки в GitHub Action: загрузка неотредактированного результата и возможность подделки выходных значений. Исправления включают чтение отредактированной копии перед загрузкой и очистку выходных данных от символов новой строки.

Задача

A security tool’s GitHub Action uploaded unredacted data and allowed output forging, exposing secrets and bypassing gate checks.

Результат

The Action now uploads only redacted data and prevents output forging, reducing false positives and protecting secrets.

Рабочий процесс

• 1. Run audit: sechelix audit "$PATH" --json > sechelix-run.json
• 2. Upload artifact: actions/upload-artifact@... with path: sechelix-run.json
• 3. Identify bug: raw JSON contained secrets.
• 4. Fix upload: use sechelix report --format json to read persisted, redacted copy.
• 5. Detect output forging: review GITHUB_OUTPUT handling.
• 6. Fix forging: sanitize newline characters and enforce single key per output.
• 7. Add regression tests to confirm fixes.

Доказательства

So the Action was uploading the unredacted projection into a build artifact that anyone with read access to the repository can download

Источник

The fix is one line: re-read the persisted copy with sechelix report --format json before uploading anything.

Источник

A value containing a newline writes a second key… When a key appears twice, the runner takes the last one.

Источник