I pointed my own security tool at my own GitHub Action. It found two bugs.

说明与用途

SecHelix 内部测试发现其 GitHub Action 存在两处错误：上传未脱敏的工件和输出值被伪造。修复方法是先读取已脱敏的副本再上传，并对输出进行清理以防止伪造。

问题

A security tool’s GitHub Action uploaded unredacted data and allowed output forging, exposing secrets and bypassing gate checks.

结果

The Action now uploads only redacted data and prevents output forging, reducing false positives and protecting secrets.

工作流

• 1. Run audit: sechelix audit "$PATH" --json > sechelix-run.json
• 2. Upload artifact: actions/upload-artifact@... with path: sechelix-run.json
• 3. Identify bug: raw JSON contained secrets.
• 4. Fix upload: use sechelix report --format json to read persisted, redacted copy.
• 5. Detect output forging: review GITHUB_OUTPUT handling.
• 6. Fix forging: sanitize newline characters and enforce single key per output.
• 7. Add regression tests to confirm fixes.

证据

So the Action was uploading the unredacted projection into a build artifact that anyone with read access to the repository can download

来源

The fix is one line: re-read the persisted copy with sechelix report --format json before uploading anything.

来源

A value containing a newline writes a second key… When a key appears twice, the runner takes the last one.

来源