┌──────────────────┐
│ 35 Code Findings │
└──────────────────┘
.github/workflow-templates/cargo-build/action.yml
❯❯❱ yaml.github-actions.security.run-shell-injection.run-shell-injection
❰❰ Blocking ❱❱
Using variable interpolation `${{...}}` with `github` context data in a `run:` step could allow an
attacker to inject their own code into the runner. This would allow them to steal secrets and code.
`github` context data can have arbitrary user input and should be treated as untrusted. Instead, use
an intermediate environment variable with `env:` to store the data and use the environment variable
in the `run:` script. Be sure to use double-quotes the environment variable, like this: "$ENVVAR".
Details: https://sg.run/pkzk
67┆ run: |
68┆ features_flags="${{ inputs.features }}|${{ env.RUSTFLAGS }}"
69┆ echo "features_flags: $features_flags"
70┆ key_hash=$(echo "$features_flags" | sha256sum | cut -d' ' -f1)
71┆ commit_hash=$(git rev-parse HEAD)
72┆ key="cargo-build-key-${key_hash}-${commit_hash}"
73┆ echo "Computed cache key: $key"
74┆ echo "key=$key" >> $GITHUB_OUTPUT
75┆
⋮┆----------------------------------------
86┆ run: |
87┆ params=" --locked --release"
88┆ if [ -n "${{ inputs.features }}" ]; then
89┆ params="$params --features ${{ inputs.features }}"
90┆ fi
91┆ echo "cargo build $params"
92┆ cargo build $params
93┆
.github/workflow-templates/copy-parachain-node-binaries/action.yml
❯❯❱ yaml.github-actions.security.run-shell-injection.run-shell-injection
❰❰ Blocking ❱❱
Using variable interpolation `${{...}}` with `github` context data in a `run:` step could allow an
attacker to inject their own code into the runner. This would allow them to steal secrets and code.
`github` context data can have arbitrary user input and should be treated as untrusted. Instead, use
an intermediate environment variable with `env:` to store the data and use the environment variable
in the `run:` script. Be sure to use double-quotes the environment variable, like this: "$ENVVAR".
Details: https://sg.run/pkzk
17┆ run: |
18┆ mkdir -p binaries
19┆ suffix=""
20┆ if [ "${{ inputs.cpu }}" != "" ]; then
21┆ suffix="-${{ inputs.cpu }}"
22┆ fi
23┆
24┆ cp target/${{ inputs.profile }}/tanssi-node binaries/tanssi-node$suffix
25┆ cp target/${{ inputs.profile }}/container-chain-frontier-node binaries/container-chain-
frontier-node$suffix
26┆ cp target/${{ inputs.profile }}/container-chain-simple-node binaries/container-chain-
simple-node$suffix
.github/workflow-templates/copy-relaychain-node-binaries/action.yml
❯❯❱ yaml.github-actions.security.run-shell-injection.run-shell-injection
❰❰ Blocking ❱❱
Using variable interpolation `${{...}}` with `github` context data in a `run:` step could allow an
attacker to inject their own code into the runner. This would allow them to steal secrets and code.
`github` context data can have arbitrary user input and should be treated as untrusted. Instead, use
an intermediate environment variable with `env:` to store the data and use the environment variable
in the `run:` script. Be sure to use double-quotes the environment variable, like this: "$ENVVAR".
Details: https://sg.run/pkzk
17┆ run: |
18┆ mkdir -p binaries
19┆ suffix=""
20┆ if [ "${{ inputs.cpu }}" != "" ]; then
21┆ suffix="-${{ inputs.cpu }}"
22┆ fi
23┆
24┆ cp target/${{ inputs.profile }}/tanssi-relay binaries/tanssi-relay$suffix
25┆ cp target/${{ inputs.profile }}/tanssi-relay-execute-worker binaries/tanssi-relay-
execute-worker$suffix
26┆ cp target/${{ inputs.profile }}/tanssi-relay-prepare-worker binaries/tanssi-relay-
prepare-worker$suffix
.github/workflow-templates/publish-node-docker/action.yml
❯❯❱ yaml.github-actions.security.run-shell-injection.run-shell-injection
❰❰ Blocking ❱❱
Using variable interpolation `${{...}}` with `github` context data in a `run:` step could allow an
attacker to inject their own code into the runner. This would allow them to steal secrets and code.
`github` context data can have arbitrary user input and should be treated as untrusted. Instead, use
an intermediate environment variable with `env:` to store the data and use the environment variable
in the `run:` script. Be sure to use double-quotes the environment variable, like this: "$ENVVAR".
Details: https://sg.run/pkzk
16┆ run: |
17┆ DOCKER_IMAGE=moondancelabs/${{ inputs.image }}
18┆ VERSION="${{ inputs.tag }}"
19┆ CLEAN_VERSION="${VERSION%%-*}"
20┆ COMMIT=`git rev-list -n 1 '${{ inputs.tag }}'`
21┆ SHA=sha-${COMMIT::8}
22┆ echo using "${DOCKER_IMAGE}:${SHA} as base image"
23┆
24┆ echo building "${DOCKER_IMAGE}:${CLEAN_VERSION}"
25┆ docker build \
[hid 27 additional lines, adjust with --max-lines-per-finding]
.github/workflow-templates/publish-runtime-docker/action.yml
❯❯❱ yaml.github-actions.security.run-shell-injection.run-shell-injection
❰❰ Blocking ❱❱
Using variable interpolation `${{...}}` with `github` context data in a `run:` step could allow an
attacker to inject their own code into the runner. This would allow them to steal secrets and code.
`github` context data can have arbitrary user input and should be treated as untrusted. Instead, use
an intermediate environment variable with `env:` to store the data and use the environment variable
in the `run:` script. Be sure to use double-quotes the environment variable, like this: "$ENVVAR".
Details: https://sg.run/pkzk
16┆ run: |
17┆ DOCKER_IMAGE=moondancelabs/${{ inputs.image }}
18┆ DOCKER_TAG="${{ inputs.tag }}"
19┆ COMMIT=`git rev-list -n 1 '${{ inputs.tag }}'`
20┆ SHA=sha-${COMMIT::8}
21┆ echo tagging "${DOCKER_IMAGE}:${SHA}"
22┆ docker pull "${DOCKER_IMAGE}:${SHA}"
23┆ docker tag "${DOCKER_IMAGE}:${SHA}" "${DOCKER_IMAGE}:${DOCKER_TAG}"
24┆ docker push "${DOCKER_IMAGE}:${DOCKER_TAG}"
.github/workflow-templates/typescript-tests-moonwall/action.yml
❯❯❱ yaml.github-actions.security.run-shell-injection.run-shell-injection
❰❰ Blocking ❱❱
Using variable interpolation `${{...}}` with `github` context data in a `run:` step could allow an
attacker to inject their own code into the runner. This would allow them to steal secrets and code.
`github` context data can have arbitrary user input and should be treated as untrusted. Instead, use
an intermediate environment variable with `env:` to store the data and use the environment variable
in the `run:` script. Be sure to use double-quotes the environment variable, like this: "$ENVVAR".
Details: https://sg.run/pkzk
40┆ run: |
41┆ cd ./test
42┆ pnpm moonwall test ${{ inputs.moonwall-environment }} || [[ '${{ inputs.force-pass }}' ==
'true' ]]
.github/workflows/bump-runtime-versions.yml
❯❯❱ yaml.github-actions.security.run-shell-injection.run-shell-injection
❰❰ Blocking ❱❱
Using variable interpolation `${{...}}` with `github` context data in a `run:` step could allow an
attacker to inject their own code into the runner. This would allow them to steal secrets and code.
`github` context data can have arbitrary user input and should be treated as untrusted. Instead, use
an intermediate environment variable with `env:` to store the data and use the environment variable
in the `run:` script. Be sure to use double-quotes the environment variable, like this: "$ENVVAR".
Details: https://sg.run/pkzk
25┆ run: |
26┆ if [[ "${{ github.event_name }}" == "workflow_dispatch" ]]; then
27┆ echo "branch=${{ github.event.inputs.branch }}" >> $GITHUB_OUTPUT
28┆ else
29┆ echo "branch=master" >> $GITHUB_OUTPUT
30┆ fi
31┆
.github/workflows/client-release-issue.yml
❯❯❱ yaml.github-actions.security.run-shell-injection.run-shell-injection
❰❰ Blocking ❱❱
Using variable interpolation `${{...}}` with `github` context data in a `run:` step could allow an
attacker to inject their own code into the runner. This would allow them to steal secrets and code.
`github` context data can have arbitrary user input and should be treated as untrusted. Instead, use
an intermediate environment variable with `env:` to store the data and use the environment variable
in the `run:` script. Be sure to use double-quotes the environment variable, like this: "$ENVVAR".
Details: https://sg.run/pkzk
48┆ run: |
49┆ npm i
50┆ npm run --silent print-client-release-issue -- --chainType ${{
github.event.inputs.binary-type }} --from ${{ github.event.inputs.from }} --to ${{
github.event.inputs.to }} | tee ../client-release-issue.md
.github/workflows/docker-runtime-draft.yml
❯❯❱ yaml.github-actions.security.run-shell-injection.run-shell-injection
❰❰ Blocking ❱❱
Using variable interpolation `${{...}}` with `github` context data in a `run:` step could allow an
attacker to inject their own code into the runner. This would allow them to steal secrets and code.
`github` context data can have arbitrary user input and should be treated as untrusted. Instead, use
an intermediate environment variable with `env:` to store the data and use the environment variable
in the `run:` script. Be sure to use double-quotes the environment variable, like this: "$ENVVAR".
Details: https://sg.run/pkzk
36┆ run: |
37┆ if [[ "${{ github.event_name }}" == "workflow_dispatch" ]]; then
38┆ echo "git_ref=${{ github.event.inputs.branch }}" >> $GITHUB_OUTPUT
39┆ echo "git_branch=${{ github.event.inputs.branch }}" >> $GITHUB_OUTPUT
40┆ else
41┆ echo "git_ref=${{ github.event.inputs.to }}" >> $GITHUB_OUTPUT
42┆ echo "git_branch=$(echo ${GITHUB_REF##*/})" >> $GITHUB_OUTPUT
43┆ echo ${GITHUB_REF##*/}
44┆ fi
.github/workflows/publish-binary-from-docker.yml
❯❯❱ yaml.github-actions.security.run-shell-injection.run-shell-injection
❰❰ Blocking ❱❱
Using variable interpolation `${{...}}` with `github` context data in a `run:` step could allow an
attacker to inject their own code into the runner. This would allow them to steal secrets and code.
`github` context data can have arbitrary user input and should be treated as untrusted. Instead, use
an intermediate environment variable with `env:` to store the data and use the environment variable
in the `run:` script. Be sure to use double-quotes the environment variable, like this: "$ENVVAR".
Details: https://sg.run/pkzk
37┆ run: |
38┆ ./test/scripts/download-latest-rt-binaries.sh ${{ github.event.inputs.binaries }}
--include-all-archs --tag ${{ github.event.inputs.docker_tag }}
.github/workflows/publish-binary-tanssi-solochain.yml
❯❯❱ yaml.github-actions.security.run-shell-injection.run-shell-injection
❰❰ Blocking ❱❱
Using variable interpolation `${{...}}` with `github` context data in a `run:` step could allow an
attacker to inject their own code into the runner. This would allow them to steal secrets and code.
`github` context data can have arbitrary user input and should be treated as untrusted. Instead, use
an intermediate environment variable with `env:` to store the data and use the environment variable
in the `run:` script. Be sure to use double-quotes the environment variable, like this: "$ENVVAR".
Details: https://sg.run/pkzk
86┆ run: |
87┆ yarn
88┆ yarn -s run ts-node github/generate-release-body.ts --owner "${{ github.repository_owner
}}" --repo "$(basename ${{ github.repository }})" --from ${{ github.event.inputs.from }}
--to ${{ github.event.inputs.to }} --srtool-report-folder '../build/' > ../body.md
.github/workflows/publish-binary.yml
❯❯❱ yaml.github-actions.security.run-shell-injection.run-shell-injection
❰❰ Blocking ❱❱
Using variable interpolation `${{...}}` with `github` context data in a `run:` step could allow an
attacker to inject their own code into the runner. This would allow them to steal secrets and code.
`github` context data can have arbitrary user input and should be treated as untrusted. Instead, use
an intermediate environment variable with `env:` to store the data and use the environment variable
in the `run:` script. Be sure to use double-quotes the environment variable, like this: "$ENVVAR".
Details: https://sg.run/pkzk
87┆ run: |
88┆ yarn
89┆ yarn -s run ts-node github/generate-release-body.ts --owner "${{ github.repository_owner
}}" --repo "$(basename ${{ github.repository }})" --from ${{ github.event.inputs.from }}
--to ${{ github.event.inputs.to }} --srtool-report-folder '../build/' > ../body.md
.github/workflows/publish-docker-tanssi-solochain.yml
❯❯❱ yaml.github-actions.security.run-shell-injection.run-shell-injection
❰❰ Blocking ❱❱
Using variable interpolation `${{...}}` with `github` context data in a `run:` step could allow an
attacker to inject their own code into the runner. This would allow them to steal secrets and code.
`github` context data can have arbitrary user input and should be treated as untrusted. Instead, use
an intermediate environment variable with `env:` to store the data and use the environment variable
in the `run:` script. Be sure to use double-quotes the environment variable, like this: "$ENVVAR".
Details: https://sg.run/pkzk
32┆ run: |
33┆ mkdir -p build
34┆ VERSION="${{ github.event.inputs.tag }}"
35┆ wget "${{ env.BASE_URL }}/$VERSION/${{ matrix.image.file_name }}" -O build/${{
matrix.image.file_name }}
36┆ wget "${{ env.BASE_URL }}/$VERSION/${{ matrix.image.file_name }}-execute-worker" -O
build/${{ matrix.image.file_name }}-execute-worker
37┆ wget "${{ env.BASE_URL }}/$VERSION/${{ matrix.image.file_name }}-prepare-worker" -O
build/${{ matrix.image.file_name }}-prepare-worker
38┆
39┆ wget "${{ env.BASE_URL }}/$VERSION/${{ matrix.image.file_name }}-skylake" -O build/${{
matrix.image.file_name }}-skylake
40┆ wget "${{ env.BASE_URL }}/$VERSION/${{ matrix.image.file_name }}-execute-worker-skylake"
-O build/${{ matrix.image.file_name }}-execute-worker-skylake
41┆ wget "${{ env.BASE_URL }}/$VERSION/${{ matrix.image.file_name }}-prepare-worker-skylake"
-O build/${{ matrix.image.file_name }}-prepare-worker-skylake
[hid 5 additional lines, adjust with --max-lines-per-finding]
.github/workflows/publish-docker.yml
❯❯❱ yaml.github-actions.security.run-shell-injection.run-shell-injection
❰❰ Blocking ❱❱
Using variable interpolation `${{...}}` with `github` context data in a `run:` step could allow an
attacker to inject their own code into the runner. This would allow them to steal secrets and code.
`github` context data can have arbitrary user input and should be treated as untrusted. Instead, use
an intermediate environment variable with `env:` to store the data and use the environment variable
in the `run:` script. Be sure to use double-quotes the environment variable, like this: "$ENVVAR".
Details: https://sg.run/pkzk
34┆ run: |
35┆ mkdir -p build
36┆ VERSION="${{ github.event.inputs.tag }}"
37┆ wget "${{ env.BASE_URL }}/$VERSION/${{ matrix.image.file_name }}" -O build/${{
matrix.image.file_name }}
38┆ wget "${{ env.BASE_URL }}/$VERSION/${{ matrix.image.file_name }}-skylake" -O build/${{
matrix.image.file_name }}-skylake
39┆ wget "${{ env.BASE_URL }}/$VERSION/${{ matrix.image.file_name }}-znver3" -O build/${{
matrix.image.file_name }}-znver3
40┆
.github/workflows/publish-runtime.yml
❯❯❱ yaml.github-actions.security.run-shell-injection.run-shell-injection
❰❰ Blocking ❱❱
Using variable interpolation `${{...}}` with `github` context data in a `run:` step could allow an
attacker to inject their own code into the runner. This would allow them to steal secrets and code.
`github` context data can have arbitrary user input and should be treated as untrusted. Instead, use
an intermediate environment variable with `env:` to store the data and use the environment variable
in the `run:` script. Be sure to use double-quotes the environment variable, like this: "$ENVVAR".
Details: https://sg.run/pkzk
67┆ run: |
68┆ dancebox='{"runtime_name": "dancebox","runtime_path" : "./chains/orchestrator-
paras/runtime/dancebox/src/lib.rs", "build_features": "metadata-hash"}'
69┆ flashbox='{"runtime_name": "flashbox","runtime_path" : "./chains/orchestrator-
paras/runtime/flashbox/src/lib.rs", "build_features": "metadata-hash"}'
70┆ frontier_template='{"runtime_name": "frontier-template","runtime_path" :
"./chains/container-chains/runtime-templates/frontier/src/lib.rs", "build_features":
"metadata-hash"}'
71┆ simple_template='{"runtime_name": "simple-template","runtime_path" : "./chains/container-
chains/runtime-templates/simple/src/lib.rs", "build_features": "metadata-hash"}'
72┆ dancelight='{"runtime_name": "dancelight","runtime_path" : "./chains/orchestrator-
relays/runtime/dancelight/src/lib.rs", "build_features": "on-chain-release-build"}'
73┆ starlight='{"runtime_name": "starlight","runtime_path" : "./chains/orchestrator-
relays/runtime/starlight/src/lib.rs", "build_features": "on-chain-release-build"}'
74┆
75┆ if [[ ${{ github.event.inputs.chains }} = "orchestrator-para-only" ]]; then
76┆ echo "matrix_tests=[$dancebox, $flashbox]" >> $GITHUB_OUTPUT
[hid 19 additional lines, adjust with --max-lines-per-finding]
207┆ run: |
208┆ RUNTIMES=$(echo '${{needs.matrix_prep.outputs.matrix_tests}}' | jq -r '.[] |
.runtime_name + " "')
209┆ yarn
210┆ yarn -s run ts-node github/generate-runtimes-body.ts --owner "${{ github.repository_owner
}}" --repo "$(basename ${{ github.repository }})" --from "${{ github.event.inputs.from }}"
--to "${{ github.event.inputs.to }}" --srtool-report-folder '../build/' --runtimes
$RUNTIMES > ../body.md - name: Get runtime version
⋮┆----------------------------------------
213┆ run: |
214┆ version="$(echo ${{ github.event.inputs.to }} | grep -o '[0-9]*')"
215┆ name="$(echo ${{ github.event.inputs.chains }} | sed -e 's/\(-only\)*$//g')"
216┆ title="$name $version"
217┆ echo "title=$title" >> $GITHUB_OUTPUT
.github/workflows/release.yml
❯❯❱ yaml.github-actions.security.run-shell-injection.run-shell-injection
❰❰ Blocking ❱❱
Using variable interpolation `${{...}}` with `github` context data in a `run:` step could allow an
attacker to inject their own code into the runner. This would allow them to steal secrets and code.
`github` context data can have arbitrary user input and should be treated as untrusted. Instead, use
an intermediate environment variable with `env:` to store the data and use the environment variable
in the `run:` script. Be sure to use double-quotes the environment variable, like this: "$ENVVAR".
Details: https://sg.run/pkzk
31┆ run: |
32┆ if [[ -n "${{ github.event.pull_request.head.sha }}" ]]; then
33┆ echo "git_branch=$(echo ${GITHUB_HEAD_REF})" >> $GITHUB_OUTPUT
34┆ echo "git_ref=${{ github.event.pull_request.head.sha }}" >> $GITHUB_OUTPUT
35┆ elif [[ -n "${{ github.event.inputs.pull_request }}" ]]; then
36┆ echo "git_branch=$(echo ${GITHUB_HEAD_REF})" >> $GITHUB_OUTPUT
37┆ echo "git_ref=refs/pull/${{ github.event.inputs.pull_request }}/head" >>
$GITHUB_OUTPUT
38┆ else
39┆ echo "git_branch=$(echo ${GITHUB_REF#refs/heads/})" >> $GITHUB_OUTPUT
40┆ echo "git_ref=$GITHUB_REF" >> $GITHUB_OUTPUT
[hid 1 additional lines, adjust with --max-lines-per-finding]
.github/workflows/run-zombienet-tests.yml
❯❯❱ yaml.github-actions.security.run-shell-injection.run-shell-injection
❰❰ Blocking ❱❱
Using variable interpolation `${{...}}` with `github` context data in a `run:` step could allow an
attacker to inject their own code into the runner. This would allow them to steal secrets and code.
`github` context data can have arbitrary user input and should be treated as untrusted. Instead, use
an intermediate environment variable with `env:` to store the data and use the environment variable
in the `run:` script. Be sure to use double-quotes the environment variable, like this: "$ENVVAR".
Details: https://sg.run/pkzk
63┆ run: |
64┆ foundation_type="${{ github.event.inputs.foundation_type || 'zombie' }}"
65┆ test_name="${{ github.event.inputs.test_name || '' }}"
66┆ test_bundle="${{ github.event.inputs.test_bundle || 'weekly_bundle' }}"
67┆
68┆ echo "Input test_name: $test_name"
69┆ echo "Input bundle: $test_bundle"
70┆
71┆ if [ -z "$test_name" ]; then
72┆ if [ "$test_bundle" == "weekly_bundle" ]; then
[hid 23 additional lines, adjust with --max-lines-per-finding]
205┆ run: |
206┆ ~/bin/bin/gh issue create \
207┆ --title "🚨 Zombienet Test Failure in ${{ github.workflow }}" \
208┆ --body "Tests ${{ matrix.test_name }} failed in [${{ github.workflow }}](${{
github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_id
}}).\n\n@moondance-labs/coredev please investigate." \
209┆ --repo "${{ github.repository }}"
.github/workflows/runtime-release-issue.yml
❯❯❱ yaml.github-actions.security.run-shell-injection.run-shell-injection
❰❰ Blocking ❱❱
Using variable interpolation `${{...}}` with `github` context data in a `run:` step could allow an
attacker to inject their own code into the runner. This would allow them to steal secrets and code.
`github` context data can have arbitrary user input and should be treated as untrusted. Instead, use
an intermediate environment variable with `env:` to store the data and use the environment variable
in the `run:` script. Be sure to use double-quotes the environment variable, like this: "$ENVVAR".
Details: https://sg.run/pkzk
45┆ run: |
46┆ npm i
47┆ npm run --silent print-runtime-release-issue -- --from ${{ github.event.inputs.from }}
--to ${{ github.event.inputs.to }} --client ${{ github.event.inputs.client }} | tee
../runtime-release-issue.md
.github/workflows/test-all-benchmarks-schedule.yml
❯❯❱ yaml.github-actions.security.run-shell-injection.run-shell-injection
❰❰ Blocking ❱❱
Using variable interpolation `${{...}}` with `github` context data in a `run:` step could allow an
attacker to inject their own code into the runner. This would allow them to steal secrets and code.
`github` context data can have arbitrary user input and should be treated as untrusted. Instead, use
an intermediate environment variable with `env:` to store the data and use the environment variable
in the `run:` script. Be sure to use double-quotes the environment variable, like this: "$ENVVAR".
Details: https://sg.run/pkzk
26┆ run: |
27┆ if [[ "${{ github.event_name }}" == "workflow_dispatch" ]]; then
28┆ echo "branch=${{ github.event.inputs.branch }}" >> $GITHUB_OUTPUT
29┆ else
30┆ echo "branch=master" >> $GITHUB_OUTPUT
31┆ fi
32┆
.github/workflows/upgrade-typescript-api.yml
❯❯❱ yaml.github-actions.security.run-shell-injection.run-shell-injection
❰❰ Blocking ❱❱
Using variable interpolation `${{...}}` with `github` context data in a `run:` step could allow an
attacker to inject their own code into the runner. This would allow them to steal secrets and code.
`github` context data can have arbitrary user input and should be treated as untrusted. Instead, use
an intermediate environment variable with `env:` to store the data and use the environment variable
in the `run:` script. Be sure to use double-quotes the environment variable, like this: "$ENVVAR".
Details: https://sg.run/pkzk
44┆ run: |
45┆ COMMIT=`git rev-list -n 1 'runtime-${{ github.event.inputs.spec_version }}'`
46┆ echo "FINISHED"
47┆ SHA=sha-${COMMIT::8}
48┆ DOCKER_TAG="moondancelabs/tanssi:$SHA"
49┆
50┆ # Clear the dummy container if it wasn't properly cleaned up
51┆ docker rm -f dummy 2> /dev/null
52┆ docker create -ti --name dummy $DOCKER_TAG bash
53┆ mkdir -p target/release
[hid 3 additional lines, adjust with --max-lines-per-finding]
70┆ run: |
71┆ cd typescript-api
72┆ pnpm version --no-git-tag-version 0.${{ github.event.inputs.spec_version }}.0
.github/workflows/version-bump.yml
❯❯❱ yaml.github-actions.security.run-shell-injection.run-shell-injection
❰❰ Blocking ❱❱
Using variable interpolation `${{...}}` with `github` context data in a `run:` step could allow an
attacker to inject their own code into the runner. This would allow them to steal secrets and code.
`github` context data can have arbitrary user input and should be treated as untrusted. Instead, use
an intermediate environment variable with `env:` to store the data and use the environment variable
in the `run:` script. Be sure to use double-quotes the environment variable, like this: "$ENVVAR".
Details: https://sg.run/pkzk
25┆ run: |
26┆ cd tools
27┆ yarn install
28┆ yarn --silent run print-version-bump-info -- --from ${{ github.event.inputs.from }} --to
${{ github.event.inputs.to }} | tee ../version-bump.md
client/service-container-chain-spawner/src/spawner.rs
❯❯❱ rust.actix.path-traversal.tainted-path.tainted-path
❰❰ Blocking ❱❱
The application builds a file path from potentially untrusted data, which can lead to a path
traversal vulnerability. An attacker can manipulate the path which the application uses to access
files. If the application does not validate user input and sanitize file paths, sensitive files such
as configuration or user data can be accessed, potentially creating or overwriting files. To prevent
this vulnerability, validate and sanitize any input that is used to create references to file paths.
Also, enforce strict file access controls. For example, choose privileges allowing public-facing
applications to access only the required files.
Details: https://sg.run/YWX5
1282┆ let entry_iter = std::fs::read_dir(&paritydb_path)?;
client/service-orchestrator-chain/src/solochain.rs
❯❯❱ rust.actix.path-traversal.tainted-path.tainted-path
❰❰ Blocking ❱❱
The application builds a file path from potentially untrusted data, which can lead to a path
traversal vulnerability. An attacker can manipulate the path which the application uses to access
files. If the application does not validate user input and sanitize file paths, sensitive files such
as configuration or user data can be accessed, potentially creating or overwriting files. To prevent
this vulnerability, validate and sanitize any input that is used to create references to file paths.
Also, enforce strict file access controls. For example, choose privileges allowing public-facing
applications to access only the required files.
Details: https://sg.run/YWX5
693┆ for entry in fs::read_dir(src)? {
tools/github/generate-runtimes-body.ts
❯❯❱ javascript.lang.security.detect-child-process.detect-child-process
❰❰ Blocking ❱❱
Detected calls to child_process from a function argument `runtimeName`. This could lead to a command
injection if the input is user controllable. Try to avoid calls to child_process, and if it is
needed ensure user input is correctly sanitized or sandboxed.
Details: https://sg.run/l2lo
21┆ `cat ../chains/container-chains/runtime-
templates/${runtimeName.split("-template")[0]}/src/lib.rs | grep 'spec_version: [0-9]*' |
tail -1`
⋮┆----------------------------------------
33┆ `cat ../chains/orchestrator-relays/runtime/${runtimeName}/src/lib.rs | grep 'spec_version:
[0-9]*' | tail -1`
⋮┆----------------------------------------
45┆ `cat ../chains/orchestrator-paras/runtime/${runtimeName}/src/lib.rs | grep 'spec_version:
[0-9]*' | tail -1`
tools/github/github-utils.ts
❯❯❱ javascript.lang.security.detect-child-process.detect-child-process
❰❰ Blocking ❱❱
Detected calls to child_process from a function argument `packageName`. This could lead to a command
injection if the input is user controllable. Try to avoid calls to child_process, and if it is
needed ensure user input is correctly sanitized or sandboxed.
Details: https://sg.run/l2lo
10┆ `git show ${previousTag}:../Cargo.lock | grep ${packageName}? | head -1 | grep -o '".*"'`
⋮┆----------------------------------------
❯❯❱ javascript.lang.security.detect-child-process.detect-child-process
❰❰ Blocking ❱❱
Detected calls to child_process from a function argument `previousTag`. This could lead to a command
injection if the input is user controllable. Try to avoid calls to child_process, and if it is
needed ensure user input is correctly sanitized or sandboxed.
Details: https://sg.run/l2lo
10┆ `git show ${previousTag}:../Cargo.lock | grep ${packageName}? | head -1 | grep -o '".*"'`
⋮┆----------------------------------------
❯❯❱ javascript.lang.security.detect-child-process.detect-child-process
❰❰ Blocking ❱❱
Detected calls to child_process from a function argument `newTag`. This could lead to a command
injection if the input is user controllable. Try to avoid calls to child_process, and if it is
needed ensure user input is correctly sanitized or sandboxed.
Details: https://sg.run/l2lo
16┆ `git show ${newTag}:../Cargo.lock | grep ${packageName}? | head -1 | grep -o '".*"'`
⋮┆----------------------------------------
❯❯❱ javascript.lang.security.detect-child-process.detect-child-process
❰❰ Blocking ❱❱
Detected calls to child_process from a function argument `packageName`. This could lead to a command
injection if the input is user controllable. Try to avoid calls to child_process, and if it is
needed ensure user input is correctly sanitized or sandboxed.
Details: https://sg.run/l2lo
16┆ `git show ${newTag}:../Cargo.lock | grep ${packageName}? | head -1 | grep -o '".*"'`
Semgrep Scan Report
The following issues were found by Semgrep:
Full Log
┌──────────────────┐ │ 35 Code Findings │ └──────────────────┘ .github/workflow-templates/cargo-build/action.yml ❯❯❱ yaml.github-actions.security.run-shell-injection.run-shell-injection ❰❰ Blocking ❱❱ Using variable interpolation `${{...}}` with `github` context data in a `run:` step could allow an attacker to inject their own code into the runner. This would allow them to steal secrets and code. `github` context data can have arbitrary user input and should be treated as untrusted. Instead, use an intermediate environment variable with `env:` to store the data and use the environment variable in the `run:` script. Be sure to use double-quotes the environment variable, like this: "$ENVVAR". Details: https://sg.run/pkzk 67┆ run: | 68┆ features_flags="${{ inputs.features }}|${{ env.RUSTFLAGS }}" 69┆ echo "features_flags: $features_flags" 70┆ key_hash=$(echo "$features_flags" | sha256sum | cut -d' ' -f1) 71┆ commit_hash=$(git rev-parse HEAD) 72┆ key="cargo-build-key-${key_hash}-${commit_hash}" 73┆ echo "Computed cache key: $key" 74┆ echo "key=$key" >> $GITHUB_OUTPUT 75┆ ⋮┆---------------------------------------- 86┆ run: | 87┆ params=" --locked --release" 88┆ if [ -n "${{ inputs.features }}" ]; then 89┆ params="$params --features ${{ inputs.features }}" 90┆ fi 91┆ echo "cargo build $params" 92┆ cargo build $params 93┆ .github/workflow-templates/copy-parachain-node-binaries/action.yml ❯❯❱ yaml.github-actions.security.run-shell-injection.run-shell-injection ❰❰ Blocking ❱❱ Using variable interpolation `${{...}}` with `github` context data in a `run:` step could allow an attacker to inject their own code into the runner. This would allow them to steal secrets and code. `github` context data can have arbitrary user input and should be treated as untrusted. Instead, use an intermediate environment variable with `env:` to store the data and use the environment variable in the `run:` script. Be sure to use double-quotes the environment variable, like this: "$ENVVAR". Details: https://sg.run/pkzk 17┆ run: | 18┆ mkdir -p binaries 19┆ suffix="" 20┆ if [ "${{ inputs.cpu }}" != "" ]; then 21┆ suffix="-${{ inputs.cpu }}" 22┆ fi 23┆ 24┆ cp target/${{ inputs.profile }}/tanssi-node binaries/tanssi-node$suffix 25┆ cp target/${{ inputs.profile }}/container-chain-frontier-node binaries/container-chain- frontier-node$suffix 26┆ cp target/${{ inputs.profile }}/container-chain-simple-node binaries/container-chain- simple-node$suffix .github/workflow-templates/copy-relaychain-node-binaries/action.yml ❯❯❱ yaml.github-actions.security.run-shell-injection.run-shell-injection ❰❰ Blocking ❱❱ Using variable interpolation `${{...}}` with `github` context data in a `run:` step could allow an attacker to inject their own code into the runner. This would allow them to steal secrets and code. `github` context data can have arbitrary user input and should be treated as untrusted. Instead, use an intermediate environment variable with `env:` to store the data and use the environment variable in the `run:` script. Be sure to use double-quotes the environment variable, like this: "$ENVVAR". Details: https://sg.run/pkzk 17┆ run: | 18┆ mkdir -p binaries 19┆ suffix="" 20┆ if [ "${{ inputs.cpu }}" != "" ]; then 21┆ suffix="-${{ inputs.cpu }}" 22┆ fi 23┆ 24┆ cp target/${{ inputs.profile }}/tanssi-relay binaries/tanssi-relay$suffix 25┆ cp target/${{ inputs.profile }}/tanssi-relay-execute-worker binaries/tanssi-relay- execute-worker$suffix 26┆ cp target/${{ inputs.profile }}/tanssi-relay-prepare-worker binaries/tanssi-relay- prepare-worker$suffix .github/workflow-templates/publish-node-docker/action.yml ❯❯❱ yaml.github-actions.security.run-shell-injection.run-shell-injection ❰❰ Blocking ❱❱ Using variable interpolation `${{...}}` with `github` context data in a `run:` step could allow an attacker to inject their own code into the runner. This would allow them to steal secrets and code. `github` context data can have arbitrary user input and should be treated as untrusted. Instead, use an intermediate environment variable with `env:` to store the data and use the environment variable in the `run:` script. Be sure to use double-quotes the environment variable, like this: "$ENVVAR". Details: https://sg.run/pkzk 16┆ run: | 17┆ DOCKER_IMAGE=moondancelabs/${{ inputs.image }} 18┆ VERSION="${{ inputs.tag }}" 19┆ CLEAN_VERSION="${VERSION%%-*}" 20┆ COMMIT=`git rev-list -n 1 '${{ inputs.tag }}'` 21┆ SHA=sha-${COMMIT::8} 22┆ echo using "${DOCKER_IMAGE}:${SHA} as base image" 23┆ 24┆ echo building "${DOCKER_IMAGE}:${CLEAN_VERSION}" 25┆ docker build \ [hid 27 additional lines, adjust with --max-lines-per-finding] .github/workflow-templates/publish-runtime-docker/action.yml ❯❯❱ yaml.github-actions.security.run-shell-injection.run-shell-injection ❰❰ Blocking ❱❱ Using variable interpolation `${{...}}` with `github` context data in a `run:` step could allow an attacker to inject their own code into the runner. This would allow them to steal secrets and code. `github` context data can have arbitrary user input and should be treated as untrusted. Instead, use an intermediate environment variable with `env:` to store the data and use the environment variable in the `run:` script. Be sure to use double-quotes the environment variable, like this: "$ENVVAR". Details: https://sg.run/pkzk 16┆ run: | 17┆ DOCKER_IMAGE=moondancelabs/${{ inputs.image }} 18┆ DOCKER_TAG="${{ inputs.tag }}" 19┆ COMMIT=`git rev-list -n 1 '${{ inputs.tag }}'` 20┆ SHA=sha-${COMMIT::8} 21┆ echo tagging "${DOCKER_IMAGE}:${SHA}" 22┆ docker pull "${DOCKER_IMAGE}:${SHA}" 23┆ docker tag "${DOCKER_IMAGE}:${SHA}" "${DOCKER_IMAGE}:${DOCKER_TAG}" 24┆ docker push "${DOCKER_IMAGE}:${DOCKER_TAG}" .github/workflow-templates/typescript-tests-moonwall/action.yml ❯❯❱ yaml.github-actions.security.run-shell-injection.run-shell-injection ❰❰ Blocking ❱❱ Using variable interpolation `${{...}}` with `github` context data in a `run:` step could allow an attacker to inject their own code into the runner. This would allow them to steal secrets and code. `github` context data can have arbitrary user input and should be treated as untrusted. Instead, use an intermediate environment variable with `env:` to store the data and use the environment variable in the `run:` script. Be sure to use double-quotes the environment variable, like this: "$ENVVAR". Details: https://sg.run/pkzk 40┆ run: | 41┆ cd ./test 42┆ pnpm moonwall test ${{ inputs.moonwall-environment }} || [[ '${{ inputs.force-pass }}' == 'true' ]] .github/workflows/bump-runtime-versions.yml ❯❯❱ yaml.github-actions.security.run-shell-injection.run-shell-injection ❰❰ Blocking ❱❱ Using variable interpolation `${{...}}` with `github` context data in a `run:` step could allow an attacker to inject their own code into the runner. This would allow them to steal secrets and code. `github` context data can have arbitrary user input and should be treated as untrusted. Instead, use an intermediate environment variable with `env:` to store the data and use the environment variable in the `run:` script. Be sure to use double-quotes the environment variable, like this: "$ENVVAR". Details: https://sg.run/pkzk 25┆ run: | 26┆ if [[ "${{ github.event_name }}" == "workflow_dispatch" ]]; then 27┆ echo "branch=${{ github.event.inputs.branch }}" >> $GITHUB_OUTPUT 28┆ else 29┆ echo "branch=master" >> $GITHUB_OUTPUT 30┆ fi 31┆ .github/workflows/client-release-issue.yml ❯❯❱ yaml.github-actions.security.run-shell-injection.run-shell-injection ❰❰ Blocking ❱❱ Using variable interpolation `${{...}}` with `github` context data in a `run:` step could allow an attacker to inject their own code into the runner. This would allow them to steal secrets and code. `github` context data can have arbitrary user input and should be treated as untrusted. Instead, use an intermediate environment variable with `env:` to store the data and use the environment variable in the `run:` script. Be sure to use double-quotes the environment variable, like this: "$ENVVAR". Details: https://sg.run/pkzk 48┆ run: | 49┆ npm i 50┆ npm run --silent print-client-release-issue -- --chainType ${{ github.event.inputs.binary-type }} --from ${{ github.event.inputs.from }} --to ${{ github.event.inputs.to }} | tee ../client-release-issue.md .github/workflows/docker-runtime-draft.yml ❯❯❱ yaml.github-actions.security.run-shell-injection.run-shell-injection ❰❰ Blocking ❱❱ Using variable interpolation `${{...}}` with `github` context data in a `run:` step could allow an attacker to inject their own code into the runner. This would allow them to steal secrets and code. `github` context data can have arbitrary user input and should be treated as untrusted. Instead, use an intermediate environment variable with `env:` to store the data and use the environment variable in the `run:` script. Be sure to use double-quotes the environment variable, like this: "$ENVVAR". Details: https://sg.run/pkzk 36┆ run: | 37┆ if [[ "${{ github.event_name }}" == "workflow_dispatch" ]]; then 38┆ echo "git_ref=${{ github.event.inputs.branch }}" >> $GITHUB_OUTPUT 39┆ echo "git_branch=${{ github.event.inputs.branch }}" >> $GITHUB_OUTPUT 40┆ else 41┆ echo "git_ref=${{ github.event.inputs.to }}" >> $GITHUB_OUTPUT 42┆ echo "git_branch=$(echo ${GITHUB_REF##*/})" >> $GITHUB_OUTPUT 43┆ echo ${GITHUB_REF##*/} 44┆ fi .github/workflows/publish-binary-from-docker.yml ❯❯❱ yaml.github-actions.security.run-shell-injection.run-shell-injection ❰❰ Blocking ❱❱ Using variable interpolation `${{...}}` with `github` context data in a `run:` step could allow an attacker to inject their own code into the runner. This would allow them to steal secrets and code. `github` context data can have arbitrary user input and should be treated as untrusted. Instead, use an intermediate environment variable with `env:` to store the data and use the environment variable in the `run:` script. Be sure to use double-quotes the environment variable, like this: "$ENVVAR". Details: https://sg.run/pkzk 37┆ run: | 38┆ ./test/scripts/download-latest-rt-binaries.sh ${{ github.event.inputs.binaries }} --include-all-archs --tag ${{ github.event.inputs.docker_tag }} .github/workflows/publish-binary-tanssi-solochain.yml ❯❯❱ yaml.github-actions.security.run-shell-injection.run-shell-injection ❰❰ Blocking ❱❱ Using variable interpolation `${{...}}` with `github` context data in a `run:` step could allow an attacker to inject their own code into the runner. This would allow them to steal secrets and code. `github` context data can have arbitrary user input and should be treated as untrusted. Instead, use an intermediate environment variable with `env:` to store the data and use the environment variable in the `run:` script. Be sure to use double-quotes the environment variable, like this: "$ENVVAR". Details: https://sg.run/pkzk 86┆ run: | 87┆ yarn 88┆ yarn -s run ts-node github/generate-release-body.ts --owner "${{ github.repository_owner }}" --repo "$(basename ${{ github.repository }})" --from ${{ github.event.inputs.from }} --to ${{ github.event.inputs.to }} --srtool-report-folder '../build/' > ../body.md .github/workflows/publish-binary.yml ❯❯❱ yaml.github-actions.security.run-shell-injection.run-shell-injection ❰❰ Blocking ❱❱ Using variable interpolation `${{...}}` with `github` context data in a `run:` step could allow an attacker to inject their own code into the runner. This would allow them to steal secrets and code. `github` context data can have arbitrary user input and should be treated as untrusted. Instead, use an intermediate environment variable with `env:` to store the data and use the environment variable in the `run:` script. Be sure to use double-quotes the environment variable, like this: "$ENVVAR". Details: https://sg.run/pkzk 87┆ run: | 88┆ yarn 89┆ yarn -s run ts-node github/generate-release-body.ts --owner "${{ github.repository_owner }}" --repo "$(basename ${{ github.repository }})" --from ${{ github.event.inputs.from }} --to ${{ github.event.inputs.to }} --srtool-report-folder '../build/' > ../body.md .github/workflows/publish-docker-tanssi-solochain.yml ❯❯❱ yaml.github-actions.security.run-shell-injection.run-shell-injection ❰❰ Blocking ❱❱ Using variable interpolation `${{...}}` with `github` context data in a `run:` step could allow an attacker to inject their own code into the runner. This would allow them to steal secrets and code. `github` context data can have arbitrary user input and should be treated as untrusted. Instead, use an intermediate environment variable with `env:` to store the data and use the environment variable in the `run:` script. Be sure to use double-quotes the environment variable, like this: "$ENVVAR". Details: https://sg.run/pkzk 32┆ run: | 33┆ mkdir -p build 34┆ VERSION="${{ github.event.inputs.tag }}" 35┆ wget "${{ env.BASE_URL }}/$VERSION/${{ matrix.image.file_name }}" -O build/${{ matrix.image.file_name }} 36┆ wget "${{ env.BASE_URL }}/$VERSION/${{ matrix.image.file_name }}-execute-worker" -O build/${{ matrix.image.file_name }}-execute-worker 37┆ wget "${{ env.BASE_URL }}/$VERSION/${{ matrix.image.file_name }}-prepare-worker" -O build/${{ matrix.image.file_name }}-prepare-worker 38┆ 39┆ wget "${{ env.BASE_URL }}/$VERSION/${{ matrix.image.file_name }}-skylake" -O build/${{ matrix.image.file_name }}-skylake 40┆ wget "${{ env.BASE_URL }}/$VERSION/${{ matrix.image.file_name }}-execute-worker-skylake" -O build/${{ matrix.image.file_name }}-execute-worker-skylake 41┆ wget "${{ env.BASE_URL }}/$VERSION/${{ matrix.image.file_name }}-prepare-worker-skylake" -O build/${{ matrix.image.file_name }}-prepare-worker-skylake [hid 5 additional lines, adjust with --max-lines-per-finding] .github/workflows/publish-docker.yml ❯❯❱ yaml.github-actions.security.run-shell-injection.run-shell-injection ❰❰ Blocking ❱❱ Using variable interpolation `${{...}}` with `github` context data in a `run:` step could allow an attacker to inject their own code into the runner. This would allow them to steal secrets and code. `github` context data can have arbitrary user input and should be treated as untrusted. Instead, use an intermediate environment variable with `env:` to store the data and use the environment variable in the `run:` script. Be sure to use double-quotes the environment variable, like this: "$ENVVAR". Details: https://sg.run/pkzk 34┆ run: | 35┆ mkdir -p build 36┆ VERSION="${{ github.event.inputs.tag }}" 37┆ wget "${{ env.BASE_URL }}/$VERSION/${{ matrix.image.file_name }}" -O build/${{ matrix.image.file_name }} 38┆ wget "${{ env.BASE_URL }}/$VERSION/${{ matrix.image.file_name }}-skylake" -O build/${{ matrix.image.file_name }}-skylake 39┆ wget "${{ env.BASE_URL }}/$VERSION/${{ matrix.image.file_name }}-znver3" -O build/${{ matrix.image.file_name }}-znver3 40┆ .github/workflows/publish-runtime.yml ❯❯❱ yaml.github-actions.security.run-shell-injection.run-shell-injection ❰❰ Blocking ❱❱ Using variable interpolation `${{...}}` with `github` context data in a `run:` step could allow an attacker to inject their own code into the runner. This would allow them to steal secrets and code. `github` context data can have arbitrary user input and should be treated as untrusted. Instead, use an intermediate environment variable with `env:` to store the data and use the environment variable in the `run:` script. Be sure to use double-quotes the environment variable, like this: "$ENVVAR". Details: https://sg.run/pkzk 67┆ run: | 68┆ dancebox='{"runtime_name": "dancebox","runtime_path" : "./chains/orchestrator- paras/runtime/dancebox/src/lib.rs", "build_features": "metadata-hash"}' 69┆ flashbox='{"runtime_name": "flashbox","runtime_path" : "./chains/orchestrator- paras/runtime/flashbox/src/lib.rs", "build_features": "metadata-hash"}' 70┆ frontier_template='{"runtime_name": "frontier-template","runtime_path" : "./chains/container-chains/runtime-templates/frontier/src/lib.rs", "build_features": "metadata-hash"}' 71┆ simple_template='{"runtime_name": "simple-template","runtime_path" : "./chains/container- chains/runtime-templates/simple/src/lib.rs", "build_features": "metadata-hash"}' 72┆ dancelight='{"runtime_name": "dancelight","runtime_path" : "./chains/orchestrator- relays/runtime/dancelight/src/lib.rs", "build_features": "on-chain-release-build"}' 73┆ starlight='{"runtime_name": "starlight","runtime_path" : "./chains/orchestrator- relays/runtime/starlight/src/lib.rs", "build_features": "on-chain-release-build"}' 74┆ 75┆ if [[ ${{ github.event.inputs.chains }} = "orchestrator-para-only" ]]; then 76┆ echo "matrix_tests=[$dancebox, $flashbox]" >> $GITHUB_OUTPUT [hid 19 additional lines, adjust with --max-lines-per-finding] 207┆ run: | 208┆ RUNTIMES=$(echo '${{needs.matrix_prep.outputs.matrix_tests}}' | jq -r '.[] | .runtime_name + " "') 209┆ yarn 210┆ yarn -s run ts-node github/generate-runtimes-body.ts --owner "${{ github.repository_owner }}" --repo "$(basename ${{ github.repository }})" --from "${{ github.event.inputs.from }}" --to "${{ github.event.inputs.to }}" --srtool-report-folder '../build/' --runtimes $RUNTIMES > ../body.md - name: Get runtime version ⋮┆---------------------------------------- 213┆ run: | 214┆ version="$(echo ${{ github.event.inputs.to }} | grep -o '[0-9]*')" 215┆ name="$(echo ${{ github.event.inputs.chains }} | sed -e 's/\(-only\)*$//g')" 216┆ title="$name $version" 217┆ echo "title=$title" >> $GITHUB_OUTPUT .github/workflows/release.yml ❯❯❱ yaml.github-actions.security.run-shell-injection.run-shell-injection ❰❰ Blocking ❱❱ Using variable interpolation `${{...}}` with `github` context data in a `run:` step could allow an attacker to inject their own code into the runner. This would allow them to steal secrets and code. `github` context data can have arbitrary user input and should be treated as untrusted. Instead, use an intermediate environment variable with `env:` to store the data and use the environment variable in the `run:` script. Be sure to use double-quotes the environment variable, like this: "$ENVVAR". Details: https://sg.run/pkzk 31┆ run: | 32┆ if [[ -n "${{ github.event.pull_request.head.sha }}" ]]; then 33┆ echo "git_branch=$(echo ${GITHUB_HEAD_REF})" >> $GITHUB_OUTPUT 34┆ echo "git_ref=${{ github.event.pull_request.head.sha }}" >> $GITHUB_OUTPUT 35┆ elif [[ -n "${{ github.event.inputs.pull_request }}" ]]; then 36┆ echo "git_branch=$(echo ${GITHUB_HEAD_REF})" >> $GITHUB_OUTPUT 37┆ echo "git_ref=refs/pull/${{ github.event.inputs.pull_request }}/head" >> $GITHUB_OUTPUT 38┆ else 39┆ echo "git_branch=$(echo ${GITHUB_REF#refs/heads/})" >> $GITHUB_OUTPUT 40┆ echo "git_ref=$GITHUB_REF" >> $GITHUB_OUTPUT [hid 1 additional lines, adjust with --max-lines-per-finding] .github/workflows/run-zombienet-tests.yml ❯❯❱ yaml.github-actions.security.run-shell-injection.run-shell-injection ❰❰ Blocking ❱❱ Using variable interpolation `${{...}}` with `github` context data in a `run:` step could allow an attacker to inject their own code into the runner. This would allow them to steal secrets and code. `github` context data can have arbitrary user input and should be treated as untrusted. Instead, use an intermediate environment variable with `env:` to store the data and use the environment variable in the `run:` script. Be sure to use double-quotes the environment variable, like this: "$ENVVAR". Details: https://sg.run/pkzk 63┆ run: | 64┆ foundation_type="${{ github.event.inputs.foundation_type || 'zombie' }}" 65┆ test_name="${{ github.event.inputs.test_name || '' }}" 66┆ test_bundle="${{ github.event.inputs.test_bundle || 'weekly_bundle' }}" 67┆ 68┆ echo "Input test_name: $test_name" 69┆ echo "Input bundle: $test_bundle" 70┆ 71┆ if [ -z "$test_name" ]; then 72┆ if [ "$test_bundle" == "weekly_bundle" ]; then [hid 23 additional lines, adjust with --max-lines-per-finding] 205┆ run: | 206┆ ~/bin/bin/gh issue create \ 207┆ --title "🚨 Zombienet Test Failure in ${{ github.workflow }}" \ 208┆ --body "Tests ${{ matrix.test_name }} failed in [${{ github.workflow }}](${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_id }}).\n\n@moondance-labs/coredev please investigate." \ 209┆ --repo "${{ github.repository }}" .github/workflows/runtime-release-issue.yml ❯❯❱ yaml.github-actions.security.run-shell-injection.run-shell-injection ❰❰ Blocking ❱❱ Using variable interpolation `${{...}}` with `github` context data in a `run:` step could allow an attacker to inject their own code into the runner. This would allow them to steal secrets and code. `github` context data can have arbitrary user input and should be treated as untrusted. Instead, use an intermediate environment variable with `env:` to store the data and use the environment variable in the `run:` script. Be sure to use double-quotes the environment variable, like this: "$ENVVAR". Details: https://sg.run/pkzk 45┆ run: | 46┆ npm i 47┆ npm run --silent print-runtime-release-issue -- --from ${{ github.event.inputs.from }} --to ${{ github.event.inputs.to }} --client ${{ github.event.inputs.client }} | tee ../runtime-release-issue.md .github/workflows/test-all-benchmarks-schedule.yml ❯❯❱ yaml.github-actions.security.run-shell-injection.run-shell-injection ❰❰ Blocking ❱❱ Using variable interpolation `${{...}}` with `github` context data in a `run:` step could allow an attacker to inject their own code into the runner. This would allow them to steal secrets and code. `github` context data can have arbitrary user input and should be treated as untrusted. Instead, use an intermediate environment variable with `env:` to store the data and use the environment variable in the `run:` script. Be sure to use double-quotes the environment variable, like this: "$ENVVAR". Details: https://sg.run/pkzk 26┆ run: | 27┆ if [[ "${{ github.event_name }}" == "workflow_dispatch" ]]; then 28┆ echo "branch=${{ github.event.inputs.branch }}" >> $GITHUB_OUTPUT 29┆ else 30┆ echo "branch=master" >> $GITHUB_OUTPUT 31┆ fi 32┆ .github/workflows/upgrade-typescript-api.yml ❯❯❱ yaml.github-actions.security.run-shell-injection.run-shell-injection ❰❰ Blocking ❱❱ Using variable interpolation `${{...}}` with `github` context data in a `run:` step could allow an attacker to inject their own code into the runner. This would allow them to steal secrets and code. `github` context data can have arbitrary user input and should be treated as untrusted. Instead, use an intermediate environment variable with `env:` to store the data and use the environment variable in the `run:` script. Be sure to use double-quotes the environment variable, like this: "$ENVVAR". Details: https://sg.run/pkzk 44┆ run: | 45┆ COMMIT=`git rev-list -n 1 'runtime-${{ github.event.inputs.spec_version }}'` 46┆ echo "FINISHED" 47┆ SHA=sha-${COMMIT::8} 48┆ DOCKER_TAG="moondancelabs/tanssi:$SHA" 49┆ 50┆ # Clear the dummy container if it wasn't properly cleaned up 51┆ docker rm -f dummy 2> /dev/null 52┆ docker create -ti --name dummy $DOCKER_TAG bash 53┆ mkdir -p target/release [hid 3 additional lines, adjust with --max-lines-per-finding] 70┆ run: | 71┆ cd typescript-api 72┆ pnpm version --no-git-tag-version 0.${{ github.event.inputs.spec_version }}.0 .github/workflows/version-bump.yml ❯❯❱ yaml.github-actions.security.run-shell-injection.run-shell-injection ❰❰ Blocking ❱❱ Using variable interpolation `${{...}}` with `github` context data in a `run:` step could allow an attacker to inject their own code into the runner. This would allow them to steal secrets and code. `github` context data can have arbitrary user input and should be treated as untrusted. Instead, use an intermediate environment variable with `env:` to store the data and use the environment variable in the `run:` script. Be sure to use double-quotes the environment variable, like this: "$ENVVAR". Details: https://sg.run/pkzk 25┆ run: | 26┆ cd tools 27┆ yarn install 28┆ yarn --silent run print-version-bump-info -- --from ${{ github.event.inputs.from }} --to ${{ github.event.inputs.to }} | tee ../version-bump.md client/service-container-chain-spawner/src/spawner.rs ❯❯❱ rust.actix.path-traversal.tainted-path.tainted-path ❰❰ Blocking ❱❱ The application builds a file path from potentially untrusted data, which can lead to a path traversal vulnerability. An attacker can manipulate the path which the application uses to access files. If the application does not validate user input and sanitize file paths, sensitive files such as configuration or user data can be accessed, potentially creating or overwriting files. To prevent this vulnerability, validate and sanitize any input that is used to create references to file paths. Also, enforce strict file access controls. For example, choose privileges allowing public-facing applications to access only the required files. Details: https://sg.run/YWX5 1282┆ let entry_iter = std::fs::read_dir(&paritydb_path)?; client/service-orchestrator-chain/src/solochain.rs ❯❯❱ rust.actix.path-traversal.tainted-path.tainted-path ❰❰ Blocking ❱❱ The application builds a file path from potentially untrusted data, which can lead to a path traversal vulnerability. An attacker can manipulate the path which the application uses to access files. If the application does not validate user input and sanitize file paths, sensitive files such as configuration or user data can be accessed, potentially creating or overwriting files. To prevent this vulnerability, validate and sanitize any input that is used to create references to file paths. Also, enforce strict file access controls. For example, choose privileges allowing public-facing applications to access only the required files. Details: https://sg.run/YWX5 693┆ for entry in fs::read_dir(src)? { tools/github/generate-runtimes-body.ts ❯❯❱ javascript.lang.security.detect-child-process.detect-child-process ❰❰ Blocking ❱❱ Detected calls to child_process from a function argument `runtimeName`. This could lead to a command injection if the input is user controllable. Try to avoid calls to child_process, and if it is needed ensure user input is correctly sanitized or sandboxed. Details: https://sg.run/l2lo 21┆ `cat ../chains/container-chains/runtime- templates/${runtimeName.split("-template")[0]}/src/lib.rs | grep 'spec_version: [0-9]*' | tail -1` ⋮┆---------------------------------------- 33┆ `cat ../chains/orchestrator-relays/runtime/${runtimeName}/src/lib.rs | grep 'spec_version: [0-9]*' | tail -1` ⋮┆---------------------------------------- 45┆ `cat ../chains/orchestrator-paras/runtime/${runtimeName}/src/lib.rs | grep 'spec_version: [0-9]*' | tail -1` tools/github/github-utils.ts ❯❯❱ javascript.lang.security.detect-child-process.detect-child-process ❰❰ Blocking ❱❱ Detected calls to child_process from a function argument `packageName`. This could lead to a command injection if the input is user controllable. Try to avoid calls to child_process, and if it is needed ensure user input is correctly sanitized or sandboxed. Details: https://sg.run/l2lo 10┆ `git show ${previousTag}:../Cargo.lock | grep ${packageName}? | head -1 | grep -o '".*"'` ⋮┆---------------------------------------- ❯❯❱ javascript.lang.security.detect-child-process.detect-child-process ❰❰ Blocking ❱❱ Detected calls to child_process from a function argument `previousTag`. This could lead to a command injection if the input is user controllable. Try to avoid calls to child_process, and if it is needed ensure user input is correctly sanitized or sandboxed. Details: https://sg.run/l2lo 10┆ `git show ${previousTag}:../Cargo.lock | grep ${packageName}? | head -1 | grep -o '".*"'` ⋮┆---------------------------------------- ❯❯❱ javascript.lang.security.detect-child-process.detect-child-process ❰❰ Blocking ❱❱ Detected calls to child_process from a function argument `newTag`. This could lead to a command injection if the input is user controllable. Try to avoid calls to child_process, and if it is needed ensure user input is correctly sanitized or sandboxed. Details: https://sg.run/l2lo 16┆ `git show ${newTag}:../Cargo.lock | grep ${packageName}? | head -1 | grep -o '".*"'` ⋮┆---------------------------------------- ❯❯❱ javascript.lang.security.detect-child-process.detect-child-process ❰❰ Blocking ❱❱ Detected calls to child_process from a function argument `packageName`. This could lead to a command injection if the input is user controllable. Try to avoid calls to child_process, and if it is needed ensure user input is correctly sanitized or sandboxed. Details: https://sg.run/l2lo 16┆ `git show ${newTag}:../Cargo.lock | grep ${packageName}? | head -1 | grep -o '".*"'`