Repository: woodruffw/zizmor
Pull request #264 (2024-12-09 20:11:39)

fix: bump annotate-snippets to fix crash
This bumps to the latest patch version, which
is noted to fix a panic in string slicing.

Fixes https://github.com/woodruffw/zizmor/issues/263

See: https://github.com/rust-lang/annotate-snippets-rs/issues/161


Patch:
diff --git a/Cargo.lock b/Cargo.lock
index 5ccab65..68f0676 100644
--- a/Cargo.lock
+++ b/Cargo.lock
@@ -38,12 +38,12 @@ dependencies = [
 
 [[package]]
 name = "annotate-snippets"
-version = "0.11.4"
+version = "0.11.5"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "24e35ed54e5ea7997c14ed4c70ba043478db1112e98263b3b035907aa197d991"
+checksum = "710e8eae58854cdc1790fcb56cca04d712a17be849eeb81da2a724bf4bae2bc4"
 dependencies = [
  "anstyle",
- "unicode-width 0.1.14",
+ "unicode-width 0.2.0",
 ]
 
 [[package]]
@@ -481,9 +481,9 @@ checksum = "07e28edb80900c19c28f1072f2e8aeca7fa06b23cd4169cefe1af5aa3260783f"
 
 [[package]]
 name = "github-actions-models"
-version = "0.13.0"
+version = "0.14.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "d6c95b4e3a08f4d31445401b7b874eef2c9a71b6049346a792b92f428cbaf03a"
+checksum = "ef734b63e241501835d10e69e9479f35995dc7bece8fd64934f227841ddd3a16"
 dependencies = [
  "indexmap",
  "serde",
diff --git a/Cargo.toml b/Cargo.toml
index 03c9fa5..0522a48 100644
--- a/Cargo.toml
+++ b/Cargo.toml
@@ -13,7 +13,7 @@ categories = ["command-line-utilities"]
 rust-version = "1.80.1"
 
 [dependencies]
-annotate-snippets = "0.11.4"
+annotate-snippets = "0.11.5"
 anstream = "0.6.18"
 anyhow = "1.0.94"
 camino = { version = "1.1.9", features = ["serde1"] }
@@ -21,7 +21,7 @@ clap = { version = "4.5.23", features = ["derive", "env"] }
 clap-verbosity-flag = { version = "3.0.0", features = [
     "tracing",
 ], default-features = false }
-github-actions-models = "0.13.0"
+github-actions-models = "0.14.0"
 human-panic = "2.0.1"
 indexmap = "2.7.0"
 indicatif = "0.17.9"
diff --git a/docs/audits.md b/docs/audits.md
index 6f2b68e..fa8c0f6 100644
--- a/docs/audits.md
+++ b/docs/audits.md
@@ -684,6 +684,7 @@ Other resources:
 * [GitHub Actions exploitation: environment manipulation]
 * [GHSL-2024-177: Environment Variable injection in an Actions workflow of Litestar]
 * [Google & Apache Found Vulnerable to GitHub Environment Injection]
+* [Hacking with Environment Variables]
 
 ### Remediation
 
@@ -709,3 +710,4 @@ If you need to pass state between steps, consider using `GITHUB_OUTPUT` instead.
 [GHSL-2024-177: Environment Variable injection in an Actions workflow of Litestar]: https://securitylab.github.com/advisories/GHSL-2024-177_Litestar/
 [Vulnerable GitHub Actions Workflows Part 1: Privilege Escalation Inside Your CI/CD Pipeline]: https://www.legitsecurity.com/blog/github-privilege-escalation-vulnerability
 [Google & Apache Found Vulnerable to GitHub Environment Injection]: https://www.legitsecurity.com/blog/github-privilege-escalation-vulnerability-0
+[Hacking with Environment Variables]: https://www.elttam.com/blog/env/
diff --git a/docs/trophy-case.md b/docs/trophy-case.md
index d252d2a..bd21541 100644
--- a/docs/trophy-case.md
+++ b/docs/trophy-case.md
@@ -8,7 +8,7 @@ secure!
 
 !!! important
 
-    Do you contribute or maintain a big (>100 star) project that had its GitHub
+    Do you contribute to or maintain a big (>100 star) project that had its GitHub
     Actions security improved by `zizmor`? Open a PR to add it to our list!
 
 * adafruit/circuitpython#9785
@@ -17,6 +17,9 @@ secure!
 * DataDog/datadog-agent#30871
 * Diaoul/subliminal#1190
 * Homebrew/brew#18662
+* hugovk/em-keyboard#148
+* hugovk/norwegianblue#233
+* hugovk/pypistats#460
 * hynek/argon2-cffi#185
 * hynek/doc2dash#225
 * hynek/environ-config#88
@@ -25,15 +28,22 @@ secure!
 * hynek/prometheus-async#70
 * hynek/stamina#81
 * hynek/structlog#663
+* marcusvolz/strava_py#53
 * NetApp/harvest#3247
 * praetorian-inc/noseyparker#228
+* prettytable/prettytable#339
 * pyca/service-identity#75
+* pylast/pylast#465
 * pypa/pip-audit#851
+* python/cpython#127749
+* python/miss-islington#705
 * python-attrs/attrs#1368
 * python-attrs/cattrs#605
+* python-humanize/humanize#221
 * python-pillow/Pillow#8526
 * PyO3/pyo3#4774
 * rustls/rustls#2261
 * rustls/tokio-rustls#96
+* termcolor/termcolor#89
 * tornadoweb/tornado#3438
 * vlang/v#22681
diff --git a/src/audit/insecure_commands.rs b/src/audit/insecure_commands.rs
index 71e347f..57b198a 100644
--- a/src/audit/insecure_commands.rs
+++ b/src/audit/insecure_commands.rs
@@ -20,6 +20,23 @@ audit_meta!(
 );
 
 impl InsecureCommands {
+    fn insecure_commands_maybe_present<'w>(
+        &self,
+        workflow: &'w Workflow,
+        location: SymbolicLocation<'w>,
+    ) -> Result<Finding<'w>> {
+        Self::finding()
+            .confidence(Confidence::Low)
+            .severity(Severity::High)
+            .persona(Persona::Auditor)
+            .add_location(
+                location.with_keys(&["env".into()]).annotated(
+                    "non-static environment may contain ACTIONS_ALLOW_UNSECURE_COMMANDS",
+                ),
+            )
+            .build(workflow)
+    }
+
     fn insecure_commands_allowed<'w>(
         &self,
         workflow: &'w Workflow,
@@ -65,20 +82,9 @@ impl InsecureCommands {
                 match env {
                     // The entire environment block is an expression, which we
                     // can't follow (for now). Emit an auditor-only finding.
-                    LoE::Expr(_) => Some(
-                        Self::finding()
-                            .confidence(Confidence::Low)
-                            .severity(Severity::High)
-                            .persona(Persona::Auditor)
-                            .add_location(
-                                step.location()
-                                .with_keys(&["env".into()])
-                                .annotated(
-                                    "non-static environment may contain ACTIONS_ALLOW_UNSECURE_COMMANDS"
-                                )
-                            )
-                            .build(workflow)
-                    ),
+                    LoE::Expr(_) => {
+                        Some(self.insecure_commands_maybe_present(workflow, step.location()))
+                    }
                     LoE::Literal(env) => self
                         .has_insecure_commands_enabled(env)
                         .then(|| self.insecure_commands_allowed(workflow, step.location())),
@@ -105,8 +111,14 @@ impl WorkflowAudit for InsecureCommands {
 
         for job in workflow.jobs() {
             if let Job::NormalJob(normal) = *job {
-                if self.has_insecure_commands_enabled(&normal.env) {
-                    results.push(self.insecure_commands_allowed(workflow, job.location())?)
+                match &normal.env {
+                    LoE::Expr(_) => results
+                        .push(self.insecure_commands_maybe_present(workflow, job.location())?),
+                    LoE::Literal(env) => {
+                        if self.has_insecure_commands_enabled(env) {
+                            results.push(self.insecure_commands_allowed(workflow, job.location())?);
+                        }
+                    }
                 }
 
                 results.extend(self.audit_steps(workflow, job.steps())?)
diff --git a/src/github_api.rs b/src/github_api.rs
index e75f4f9..3b10ba6 100644
--- a/src/github_api.rs
+++ b/src/github_api.rs
@@ -238,7 +238,10 @@ impl Client {
             .json()?;
 
         let mut workflows = vec![];
-        for file in resp.into_iter().filter(|file| file.name.ends_with(".yml")) {
+        for file in resp
+            .into_iter()
+            .filter(|file| file.name.ends_with(".yml") || file.name.ends_with(".yaml"))
+        {
             let file_url = format!("{url}/{file}", file = file.name);
             tracing::debug!("fetching {file_url}");
 


Test patch:
diff --git a/tests/snapshots/snapshot__insecure_commands-2.snap b/tests/snapshots/snapshot__insecure_commands-2.snap
index fc7ddc3..9d725d3 100644
--- a/tests/snapshots/snapshot__insecure_commands-2.snap
+++ b/tests/snapshots/snapshot__insecure_commands-2.snap
@@ -6,8 +6,7 @@ snapshot_kind: text
 error[insecure-commands]: execution of insecure workflow commands is enabled
  --> @@INPUT@@:8:5
   |
-8 |       env:
-  |  _____^
+8 | /     env:
 9 | |       ACTIONS_ALLOW_UNSECURE_COMMANDS: yes
   | |__________________________________________^ insecure commands enabled here
   |
diff --git a/tests/snapshots/snapshot__insecure_commands.snap b/tests/snapshots/snapshot__insecure_commands.snap
index bc5d4f9..adb66e3 100644
--- a/tests/snapshots/snapshot__insecure_commands.snap
+++ b/tests/snapshots/snapshot__insecure_commands.snap
@@ -6,8 +6,7 @@ snapshot_kind: text
 error[insecure-commands]: execution of insecure workflow commands is enabled
  --> @@INPUT@@:8:5
   |
-8 |       env:
-  |  _____^
+8 | /     env:
 9 | |       ACTIONS_ALLOW_UNSECURE_COMMANDS: yes
   | |__________________________________________^ insecure commands enabled here
   |