This product is not supported for your selected
Datadog site. (
).
이 페이지는 아직 영어로 제공되지 않습니다. 번역 작업 중입니다.
현재 번역 프로젝트에 대한 질문이나 피드백이 있으신 경우
언제든지 연락주시기 바랍니다.Id: 20f14e1a-a899-4e79-9f09-b6a84cd4649b
Cloud Provider: github
Framework: CICD
Severity: Medium
Category: Insecure Configurations
Learn More
Description
GitHub Actions workflows can be triggered by a variety of events. Each trigger includes a GitHub context with details about the event, such as the user who triggered it, the branch name, and other relevant information. Some of this data, like the base repository name, changeset hash, or pull request number, is typically not controlled by the user and is unlikely to be used for injection.
Compliant Code Examples
name: check-go-coverage
on:
pull_request_target:
branches: [master]
jobs:
coverage:
name: Check Go coverage
runs-on: ubuntu-latest
steps:
- name: Checkout Source
uses: actions/checkout@v4
with:
fetch-depth: 0
- name: Set up Go 1.22.x
uses: actions/setup-go@v5
with:
go-version: 1.22.x
- name: Run test metrics script
id: testcov
run: |
make test-coverage-report | tee test-results
echo "coverage=$(cat test-results | grep "Total coverage: " test-results | cut -d ":" -f 2 | bc)" >> $GITHUB_ENV
- name: Checks if Go coverage is at least 80%
if: env.coverage < 80
run: |
echo "Go coverage is lower than 80%: ${{ env.coverage }}%"
exit 1
name: Author Workflow
on:
author:
types:
- created
jobs:
process_author:
runs-on: ubuntu-latest
steps:
- name: Greet the New Author
run: |
echo "Hello, a new author has been created!"
name: Workflow Run Workflow
on:
workflow_run:
workflows:
- "Your Workflow Name" # Replace with the name of your specific workflow
jobs:
process_workflow_run:
runs-on: ubuntu-latest
steps:
- name: Greet the New Workflow Run
run: |
echo "Hello, a new workflow run has started for 'Your Workflow Name'!"
Non-Compliant Code Examples
name: Pull Request Workflow
on:
pull_request_target:
types:
- opened
jobs:
process_pull_request:
runs-on: ubuntu-latest
steps:
- name: Echo Pull Request Body
run: |
echo "Pull Request Body: ${{ github.event.pull_request.body }}"
name: Issue Comment Workflow
on:
issue_comment:
types:
- created
jobs:
process_issue_comment:
runs-on: ubuntu-latest
steps:
- name: Echo Issue Comment Body
run: |
echo "Issue Comment Body: ${{ github.event.comment.body }}"
name: Discussion Workflow
on:
discussion:
types:
- created
jobs:
process_discussion:
runs-on: ubuntu-latest
steps:
- name: Echo Discussion Title
run: |
echo "Discussion Title: ${{ github.event.discussion.title }}"