🔍 Semgrep scan results #1487
Description
Semgrep Scan Report
The following issues were found by Semgrep:
Full Log
┌──────────────────┐
│ 34 Code Findings │
└──────────────────┘
.github/workflow-templates/cargo-build/action.yml
❯❯❱ yaml.github-actions.security.run-shell-injection.run-shell-injection
Using variable interpolation `${{...}}` with `github` context data in a `run:` step could allow an
attacker to inject their own code into the runner. This would allow them to steal secrets and code.
`github` context data can have arbitrary user input and should be treated as untrusted. Instead, use
an intermediate environment variable with `env:` to store the data and use the environment variable
in the `run:` script. Be sure to use double-quotes the environment variable, like this: "$ENVVAR".
Details: https://sg.run/pkzk
67┆ run: |
68┆ features_flags="${{ inputs.features }}|${{ env.RUSTFLAGS }}"
69┆ echo "features_flags: $features_flags"
70┆ key_hash=$(echo "$features_flags" | sha256sum | cut -d' ' -f1)
71┆ commit_hash=$(git rev-parse HEAD)
72┆ key="cargo-build-key-${key_hash}-${commit_hash}"
73┆ echo "Computed cache key: $key"
74┆ echo "key=$key" >> $GITHUB_OUTPUT
75┆
⋮┆----------------------------------------
86┆ run: |
87┆ params=" --locked --release"
88┆ if [ -n "${{ inputs.features }}" ]; then
89┆ params="$params --features ${{ inputs.features }}"
90┆ fi
91┆ echo "cargo build $params"
92┆ cargo build $params
93┆
.github/workflow-templates/copy-parachain-node-binaries/action.yml
❯❯❱ yaml.github-actions.security.run-shell-injection.run-shell-injection
Using variable interpolation `${{...}}` with `github` context data in a `run:` step could allow an
attacker to inject their own code into the runner. This would allow them to steal secrets and code.
`github` context data can have arbitrary user input and should be treated as untrusted. Instead, use
an intermediate environment variable with `env:` to store the data and use the environment variable
in the `run:` script. Be sure to use double-quotes the environment variable, like this: "$ENVVAR".
Details: https://sg.run/pkzk
17┆ run: |
18┆ mkdir -p binaries
19┆ suffix=""
20┆ if [ "${{ inputs.cpu }}" != "" ]; then
21┆ suffix="-${{ inputs.cpu }}"
22┆ fi
23┆
24┆ cp target/${{ inputs.profile }}/tanssi-node binaries/tanssi-node$suffix
25┆ cp target/${{ inputs.profile }}/container-chain-frontier-node binaries/container-chain-
frontier-node$suffix
26┆ cp target/${{ inputs.profile }}/container-chain-simple-node binaries/container-chain-
simple-node$suffix
.github/workflow-templates/copy-relaychain-node-binaries/action.yml
❯❯❱ yaml.github-actions.security.run-shell-injection.run-shell-injection
Using variable interpolation `${{...}}` with `github` context data in a `run:` step could allow an
attacker to inject their own code into the runner. This would allow them to steal secrets and code.
`github` context data can have arbitrary user input and should be treated as untrusted. Instead, use
an intermediate environment variable with `env:` to store the data and use the environment variable
in the `run:` script. Be sure to use double-quotes the environment variable, like this: "$ENVVAR".
Details: https://sg.run/pkzk
17┆ run: |
18┆ mkdir -p binaries
19┆ suffix=""
20┆ if [ "${{ inputs.cpu }}" != "" ]; then
21┆ suffix="-${{ inputs.cpu }}"
22┆ fi
23┆
24┆ cp target/${{ inputs.profile }}/tanssi-relay binaries/tanssi-relay$suffix
25┆ cp target/${{ inputs.profile }}/tanssi-relay-execute-worker binaries/tanssi-relay-
execute-worker$suffix
26┆ cp target/${{ inputs.profile }}/tanssi-relay-prepare-worker binaries/tanssi-relay-
prepare-worker$suffix
.github/workflow-templates/publish-node-docker/action.yml
❯❯❱ yaml.github-actions.security.run-shell-injection.run-shell-injection
Using variable interpolation `${{...}}` with `github` context data in a `run:` step could allow an
attacker to inject their own code into the runner. This would allow them to steal secrets and code.
`github` context data can have arbitrary user input and should be treated as untrusted. Instead, use
an intermediate environment variable with `env:` to store the data and use the environment variable
in the `run:` script. Be sure to use double-quotes the environment variable, like this: "$ENVVAR".
Details: https://sg.run/pkzk
16┆ run: |
17┆ DOCKER_IMAGE=moondancelabs/${{ inputs.image }}
18┆ VERSION="${{ inputs.tag }}"
19┆ CLEAN_VERSION="${VERSION%%-*}"
20┆ COMMIT=`git rev-list -n 1 '${{ inputs.tag }}'`
21┆ SHA=sha-${COMMIT::8}
22┆ echo using "${DOCKER_IMAGE}:${SHA} as base image"
23┆
24┆ echo building "${DOCKER_IMAGE}:${CLEAN_VERSION}"
25┆ docker build \
[hid 27 additional lines, adjust with --max-lines-per-finding]
.github/workflow-templates/publish-runtime-docker/action.yml
❯❯❱ yaml.github-actions.security.run-shell-injection.run-shell-injection
Using variable interpolation `${{...}}` with `github` context data in a `run:` step could allow an
attacker to inject their own code into the runner. This would allow them to steal secrets and code.
`github` context data can have arbitrary user input and should be treated as untrusted. Instead, use
an intermediate environment variable with `env:` to store the data and use the environment variable
in the `run:` script. Be sure to use double-quotes the environment variable, like this: "$ENVVAR".
Details: https://sg.run/pkzk
16┆ run: |
17┆ DOCKER_IMAGE=moondancelabs/${{ inputs.image }}
18┆ DOCKER_TAG="${{ inputs.tag }}"
19┆ COMMIT=`git rev-list -n 1 '${{ inputs.tag }}'`
20┆ SHA=sha-${COMMIT::8}
21┆ echo tagging "${DOCKER_IMAGE}:${SHA}"
22┆ docker pull "${DOCKER_IMAGE}:${SHA}"
23┆ docker tag "${DOCKER_IMAGE}:${SHA}" "${DOCKER_IMAGE}:${DOCKER_TAG}"
24┆ docker push "${DOCKER_IMAGE}:${DOCKER_TAG}"
.github/workflow-templates/typescript-tests-moonwall/action.yml
❯❯❱ yaml.github-actions.security.run-shell-injection.run-shell-injection
Using variable interpolation `${{...}}` with `github` context data in a `run:` step could allow an
attacker to inject their own code into the runner. This would allow them to steal secrets and code.
`github` context data can have arbitrary user input and should be treated as untrusted. Instead, use
an intermediate environment variable with `env:` to store the data and use the environment variable
in the `run:` script. Be sure to use double-quotes the environment variable, like this: "$ENVVAR".
Details: https://sg.run/pkzk
40┆ run: |
41┆ cd ./test
42┆ pnpm moonwall test ${{ inputs.moonwall-environment }} || [[ '${{ inputs.force-pass }}' ==
'true' ]]
.github/workflows/bump-runtime-versions.yml
❯❯❱ yaml.github-actions.security.run-shell-injection.run-shell-injection
Using variable interpolation `${{...}}` with `github` context data in a `run:` step could allow an
attacker to inject their own code into the runner. This would allow them to steal secrets and code.
`github` context data can have arbitrary user input and should be treated as untrusted. Instead, use
an intermediate environment variable with `env:` to store the data and use the environment variable
in the `run:` script. Be sure to use double-quotes the environment variable, like this: "$ENVVAR".
Details: https://sg.run/pkzk
25┆ run: |
26┆ if [[ "${{ github.event_name }}" == "workflow_dispatch" ]]; then
27┆ echo "branch=${{ github.event.inputs.branch }}" >> $GITHUB_OUTPUT
28┆ else
29┆ echo "branch=master" >> $GITHUB_OUTPUT
30┆ fi
31┆
.github/workflows/client-release-issue.yml
❯❯❱ yaml.github-actions.security.run-shell-injection.run-shell-injection
Using variable interpolation `${{...}}` with `github` context data in a `run:` step could allow an
attacker to inject their own code into the runner. This would allow them to steal secrets and code.
`github` context data can have arbitrary user input and should be treated as untrusted. Instead, use
an intermediate environment variable with `env:` to store the data and use the environment variable
in the `run:` script. Be sure to use double-quotes the environment variable, like this: "$ENVVAR".
Details: https://sg.run/pkzk
48┆ run: |
49┆ npm i
50┆ npm run --silent print-client-release-issue -- --chainType ${{
github.event.inputs.binary-type }} --from ${{ github.event.inputs.from }} --to ${{
github.event.inputs.to }} | tee ../client-release-issue.md
.github/workflows/docker-runtime-draft.yml
❯❯❱ yaml.github-actions.security.run-shell-injection.run-shell-injection
Using variable interpolation `${{...}}` with `github` context data in a `run:` step could allow an
attacker to inject their own code into the runner. This would allow them to steal secrets and code.
`github` context data can have arbitrary user input and should be treated as untrusted. Instead, use
an intermediate environment variable with `env:` to store the data and use the environment variable
in the `run:` script. Be sure to use double-quotes the environment variable, like this: "$ENVVAR".
Details: https://sg.run/pkzk
36┆ run: |
37┆ if [[ "${{ github.event_name }}" == "workflow_dispatch" ]]; then
38┆ echo "git_ref=${{ github.event.inputs.branch }}" >> $GITHUB_OUTPUT
39┆ echo "git_branch=${{ github.event.inputs.branch }}" >> $GITHUB_OUTPUT
40┆ else
41┆ echo "git_ref=${{ github.event.inputs.to }}" >> $GITHUB_OUTPUT
42┆ echo "git_branch=$(echo ${GITHUB_REF##*/})" >> $GITHUB_OUTPUT
43┆ echo ${GITHUB_REF##*/}
44┆ fi
.github/workflows/publish-binary-from-docker.yml
❯❯❱ yaml.github-actions.security.run-shell-injection.run-shell-injection
Using variable interpolation `${{...}}` with `github` context data in a `run:` step could allow an
attacker to inject their own code into the runner. This would allow them to steal secrets and code.
`github` context data can have arbitrary user input and should be treated as untrusted. Instead, use
an intermediate environment variable with `env:` to store the data and use the environment variable
in the `run:` script. Be sure to use double-quotes the environment variable, like this: "$ENVVAR".
Details: https://sg.run/pkzk
37┆ run: |
38┆ ./test/scripts/download-latest-rt-binaries.sh ${{ github.event.inputs.binaries }}
--include-all-archs --tag ${{ github.event.inputs.docker_tag }}
.github/workflows/publish-binary-tanssi-solochain.yml
❯❯❱ yaml.github-actions.security.run-shell-injection.run-shell-injection
Using variable interpolation `${{...}}` with `github` context data in a `run:` step could allow an
attacker to inject their own code into the runner. This would allow them to steal secrets and code.
`github` context data can have arbitrary user input and should be treated as untrusted. Instead, use
an intermediate environment variable with `env:` to store the data and use the environment variable
in the `run:` script. Be sure to use double-quotes the environment variable, like this: "$ENVVAR".
Details: https://sg.run/pkzk
86┆ run: |
87┆ yarn
88┆ yarn -s run ts-node github/generate-release-body.ts --owner "${{ github.repository_owner
}}" --repo "$(basename ${{ github.repository }})" --from ${{ github.event.inputs.from }}
--to ${{ github.event.inputs.to }} --srtool-report-folder '../build/' > ../body.md
.github/workflows/publish-binary.yml
❯❯❱ yaml.github-actions.security.run-shell-injection.run-shell-injection
Using variable interpolation `${{...}}` with `github` context data in a `run:` step could allow an
attacker to inject their own code into the runner. This would allow them to steal secrets and code.
`github` context data can have arbitrary user input and should be treated as untrusted. Instead, use
an intermediate environment variable with `env:` to store the data and use the environment variable
in the `run:` script. Be sure to use double-quotes the environment variable, like this: "$ENVVAR".
Details: https://sg.run/pkzk
87┆ run: |
88┆ yarn
89┆ yarn -s run ts-node github/generate-release-body.ts --owner "${{ github.repository_owner
}}" --repo "$(basename ${{ github.repository }})" --from ${{ github.event.inputs.from }}
--to ${{ github.event.inputs.to }} --srtool-report-folder '../build/' > ../body.md
.github/workflows/publish-docker-tanssi-solochain.yml
❯❯❱ yaml.github-actions.security.run-shell-injection.run-shell-injection
Using variable interpolation `${{...}}` with `github` context data in a `run:` step could allow an
attacker to inject their own code into the runner. This would allow them to steal secrets and code.
`github` context data can have arbitrary user input and should be treated as untrusted. Instead, use
an intermediate environment variable with `env:` to store the data and use the environment variable
in the `run:` script. Be sure to use double-quotes the environment variable, like this: "$ENVVAR".
Details: https://sg.run/pkzk
32┆ run: |
33┆ mkdir -p build
34┆ VERSION="${{ github.event.inputs.tag }}"
35┆ wget "${{ env.BASE_URL }}/$VERSION/${{ matrix.image.file_name }}" -O build/${{
matrix.image.file_name }}
36┆ wget "${{ env.BASE_URL }}/$VERSION/${{ matrix.image.file_name }}-execute-worker" -O
build/${{ matrix.image.file_name }}-execute-worker
37┆ wget "${{ env.BASE_URL }}/$VERSION/${{ matrix.image.file_name }}-prepare-worker" -O
build/${{ matrix.image.file_name }}-prepare-worker
38┆
39┆ wget "${{ env.BASE_URL }}/$VERSION/${{ matrix.image.file_name }}-skylake" -O build/${{
matrix.image.file_name }}-skylake
40┆ wget "${{ env.BASE_URL }}/$VERSION/${{ matrix.image.file_name }}-execute-worker-skylake"
-O build/${{ matrix.image.file_name }}-execute-worker-skylake
41┆ wget "${{ env.BASE_URL }}/$VERSION/${{ matrix.image.file_name }}-prepare-worker-skylake"
-O build/${{ matrix.image.file_name }}-prepare-worker-skylake
[hid 5 additional lines, adjust with --max-lines-per-finding]
.github/workflows/publish-docker.yml
❯❯❱ yaml.github-actions.security.run-shell-injection.run-shell-injection
Using variable interpolation `${{...}}` with `github` context data in a `run:` step could allow an
attacker to inject their own code into the runner. This would allow them to steal secrets and code.
`github` context data can have arbitrary user input and should be treated as untrusted. Instead, use
an intermediate environment variable with `env:` to store the data and use the environment variable
in the `run:` script. Be sure to use double-quotes the environment variable, like this: "$ENVVAR".
Details: https://sg.run/pkzk
34┆ run: |
35┆ mkdir -p build
36┆ VERSION="${{ github.event.inputs.tag }}"
37┆ wget "${{ env.BASE_URL }}/$VERSION/${{ matrix.image.file_name }}" -O build/${{
matrix.image.file_name }}
38┆ wget "${{ env.BASE_URL }}/$VERSION/${{ matrix.image.file_name }}-skylake" -O build/${{
matrix.image.file_name }}-skylake
39┆ wget "${{ env.BASE_URL }}/$VERSION/${{ matrix.image.file_name }}-znver3" -O build/${{
matrix.image.file_name }}-znver3
40┆
.github/workflows/publish-runtime.yml
❯❯❱ yaml.github-actions.security.run-shell-injection.run-shell-injection
Using variable interpolation `${{...}}` with `github` context data in a `run:` step could allow an
attacker to inject their own code into the runner. This would allow them to steal secrets and code.
`github` context data can have arbitrary user input and should be treated as untrusted. Instead, use
an intermediate environment variable with `env:` to store the data and use the environment variable
in the `run:` script. Be sure to use double-quotes the environment variable, like this: "$ENVVAR".
Details: https://sg.run/pkzk
67┆ run: |
68┆ dancebox='{"runtime_name": "dancebox","runtime_path" : "./chains/orchestrator-
paras/runtime/dancebox/src/lib.rs", "build_features": "metadata-hash"}'
69┆ flashbox='{"runtime_name": "flashbox","runtime_path" : "./chains/orchestrator-
paras/runtime/flashbox/src/lib.rs", "build_features": "metadata-hash"}'
70┆ frontier_template='{"runtime_name": "frontier-template","runtime_path" :
"./chains/container-chains/runtime-templates/frontier/src/lib.rs", "build_features":
"metadata-hash"}'
71┆ simple_template='{"runtime_name": "simple-template","runtime_path" : "./chains/container-
chains/runtime-templates/simple/src/lib.rs", "build_features": "metadata-hash"}'
72┆ dancelight='{"runtime_name": "dancelight","runtime_path" : "./chains/orchestrator-
relays/runtime/dancelight/src/lib.rs", "build_features": "on-chain-release-build"}'
73┆ starlight='{"runtime_name": "starlight","runtime_path" : "./chains/orchestrator-
relays/runtime/starlight/src/lib.rs", "build_features": "on-chain-release-build"}'
74┆
75┆ if [[ ${{ github.event.inputs.chains }} = "orchestrator-para-only" ]]; then
76┆ echo "matrix_tests=[$dancebox, $flashbox]" >> $GITHUB_OUTPUT
[hid 19 additional lines, adjust with --max-lines-per-finding]
207┆ run: |
208┆ RUNTIMES=$(echo '${{needs.matrix_prep.outputs.matrix_tests}}' | jq -r '.[] |
.runtime_name + " "')
209┆ yarn
210┆ yarn -s run ts-node github/generate-runtimes-body.ts --owner "${{ github.repository_owner
}}" --repo "$(basename ${{ github.repository }})" --from "${{ github.event.inputs.from }}"
--to "${{ github.event.inputs.to }}" --srtool-report-folder '../build/' --runtimes
$RUNTIMES > ../body.md - name: Get runtime version
⋮┆----------------------------------------
213┆ run: |
214┆ version="$(echo ${{ github.event.inputs.to }} | grep -o '[0-9]*')"
215┆ name="$(echo ${{ github.event.inputs.chains }} | sed -e 's/\(-only\)*$//g')"
216┆ title="$name $version"
217┆ echo "title=$title" >> $GITHUB_OUTPUT
.github/workflows/release.yml
❯❯❱ yaml.github-actions.security.run-shell-injection.run-shell-injection
Using variable interpolation `${{...}}` with `github` context data in a `run:` step could allow an
attacker to inject their own code into the runner. This would allow them to steal secrets and code.
`github` context data can have arbitrary user input and should be treated as untrusted. Instead, use
an intermediate environment variable with `env:` to store the data and use the environment variable
in the `run:` script. Be sure to use double-quotes the environment variable, like this: "$ENVVAR".
Details: https://sg.run/pkzk
31┆ run: |
32┆ if [[ -n "${{ github.event.pull_request.head.sha }}" ]]; then
33┆ echo "git_branch=$(echo ${GITHUB_HEAD_REF})" >> $GITHUB_OUTPUT
34┆ echo "git_ref=${{ github.event.pull_request.head.sha }}" >> $GITHUB_OUTPUT
35┆ elif [[ -n "${{ github.event.inputs.pull_request }}" ]]; then
36┆ echo "git_branch=$(echo ${GITHUB_HEAD_REF})" >> $GITHUB_OUTPUT
37┆ echo "git_ref=refs/pull/${{ github.event.inputs.pull_request }}/head" >>
$GITHUB_OUTPUT
38┆ else
39┆ echo "git_branch=$(echo ${GITHUB_REF#refs/heads/})" >> $GITHUB_OUTPUT
40┆ echo "git_ref=$GITHUB_REF" >> $GITHUB_OUTPUT
[hid 1 additional lines, adjust with --max-lines-per-finding]
.github/workflows/run-zombienet-tests.yml
❯❯❱ yaml.github-actions.security.run-shell-injection.run-shell-injection
Using variable interpolation `${{...}}` with `github` context data in a `run:` step could allow an
attacker to inject their own code into the runner. This would allow them to steal secrets and code.
`github` context data can have arbitrary user input and should be treated as untrusted. Instead, use
an intermediate environment variable with `env:` to store the data and use the environment variable
in the `run:` script. Be sure to use double-quotes the environment variable, like this: "$ENVVAR".
Details: https://sg.run/pkzk
63┆ run: |
64┆ foundation_type="${{ github.event.inputs.foundation_type || 'zombie' }}"
65┆ test_name="${{ github.event.inputs.test_name || '' }}"
66┆ test_bundle="${{ github.event.inputs.test_bundle || 'weekly_bundle' }}"
67┆
68┆ echo "Input test_name: $test_name"
69┆ echo "Input bundle: $test_bundle"
70┆
71┆ if [ -z "$test_name" ]; then
72┆ if [ "$test_bundle" == "weekly_bundle" ]; then
[hid 23 additional lines, adjust with --max-lines-per-finding]
.github/workflows/runtime-release-issue.yml
❯❯❱ yaml.github-actions.security.run-shell-injection.run-shell-injection
Using variable interpolation `${{...}}` with `github` context data in a `run:` step could allow an
attacker to inject their own code into the runner. This would allow them to steal secrets and code.
`github` context data can have arbitrary user input and should be treated as untrusted. Instead, use
an intermediate environment variable with `env:` to store the data and use the environment variable
in the `run:` script. Be sure to use double-quotes the environment variable, like this: "$ENVVAR".
Details: https://sg.run/pkzk
45┆ run: |
46┆ npm i
47┆ npm run --silent print-runtime-release-issue -- --from ${{ github.event.inputs.from }}
--to ${{ github.event.inputs.to }} --client ${{ github.event.inputs.client }} | tee
../runtime-release-issue.md
.github/workflows/test-all-benchmarks-schedule.yml
❯❯❱ yaml.github-actions.security.run-shell-injection.run-shell-injection
Using variable interpolation `${{...}}` with `github` context data in a `run:` step could allow an
attacker to inject their own code into the runner. This would allow them to steal secrets and code.
`github` context data can have arbitrary user input and should be treated as untrusted. Instead, use
an intermediate environment variable with `env:` to store the data and use the environment variable
in the `run:` script. Be sure to use double-quotes the environment variable, like this: "$ENVVAR".
Details: https://sg.run/pkzk
26┆ run: |
27┆ if [[ "${{ github.event_name }}" == "workflow_dispatch" ]]; then
28┆ echo "branch=${{ github.event.inputs.branch }}" >> $GITHUB_OUTPUT
29┆ else
30┆ echo "branch=master" >> $GITHUB_OUTPUT
31┆ fi
32┆
.github/workflows/upgrade-typescript-api.yml
❯❯❱ yaml.github-actions.security.run-shell-injection.run-shell-injection
Using variable interpolation `${{...}}` with `github` context data in a `run:` step could allow an
attacker to inject their own code into the runner. This would allow them to steal secrets and code.
`github` context data can have arbitrary user input and should be treated as untrusted. Instead, use
an intermediate environment variable with `env:` to store the data and use the environment variable
in the `run:` script. Be sure to use double-quotes the environment variable, like this: "$ENVVAR".
Details: https://sg.run/pkzk
44┆ run: |
45┆ COMMIT=`git rev-list -n 1 'runtime-${{ github.event.inputs.spec_version }}'`
46┆ echo "FINISHED"
47┆ SHA=sha-${COMMIT::8}
48┆ DOCKER_TAG="moondancelabs/tanssi:$SHA"
49┆
50┆ # Clear the dummy container if it wasn't properly cleaned up
51┆ docker rm -f dummy 2> /dev/null
52┆ docker create -ti --name dummy $DOCKER_TAG bash
53┆ mkdir -p target/release
[hid 3 additional lines, adjust with --max-lines-per-finding]
70┆ run: |
71┆ cd typescript-api
72┆ pnpm version --no-git-tag-version 0.${{ github.event.inputs.spec_version }}.0
.github/workflows/version-bump.yml
❯❯❱ yaml.github-actions.security.run-shell-injection.run-shell-injection
Using variable interpolation `${{...}}` with `github` context data in a `run:` step could allow an
attacker to inject their own code into the runner. This would allow them to steal secrets and code.
`github` context data can have arbitrary user input and should be treated as untrusted. Instead, use
an intermediate environment variable with `env:` to store the data and use the environment variable
in the `run:` script. Be sure to use double-quotes the environment variable, like this: "$ENVVAR".
Details: https://sg.run/pkzk
25┆ run: |
26┆ cd tools
27┆ yarn install
28┆ yarn --silent run print-version-bump-info -- --from ${{ github.event.inputs.from }} --to
${{ github.event.inputs.to }} | tee ../version-bump.md
client/service-container-chain-spawner/src/spawner.rs
❯❯❱ rust.actix.path-traversal.tainted-path.tainted-path
The application builds a file path from potentially untrusted data, which can lead to a path
traversal vulnerability. An attacker can manipulate the path which the application uses to access
files. If the application does not validate user input and sanitize file paths, sensitive files such
as configuration or user data can be accessed, potentially creating or overwriting files. To prevent
this vulnerability, validate and sanitize any input that is used to create references to file paths.
Also, enforce strict file access controls. For example, choose privileges allowing public-facing
applications to access only the required files.
Details: https://sg.run/YWX5
1282┆ let entry_iter = std::fs::read_dir(&paritydb_path)?;
client/service-orchestrator-chain/src/solochain.rs
❯❯❱ rust.actix.path-traversal.tainted-path.tainted-path
The application builds a file path from potentially untrusted data, which can lead to a path
traversal vulnerability. An attacker can manipulate the path which the application uses to access
files. If the application does not validate user input and sanitize file paths, sensitive files such
as configuration or user data can be accessed, potentially creating or overwriting files. To prevent
this vulnerability, validate and sanitize any input that is used to create references to file paths.
Also, enforce strict file access controls. For example, choose privileges allowing public-facing
applications to access only the required files.
Details: https://sg.run/YWX5
693┆ for entry in fs::read_dir(src)? {
tools/github/generate-runtimes-body.ts
❯❯❱ javascript.lang.security.detect-child-process.detect-child-process
Detected calls to child_process from a function argument `runtimeName`. This could lead to a command
injection if the input is user controllable. Try to avoid calls to child_process, and if it is
needed ensure user input is correctly sanitized or sandboxed.
Details: https://sg.run/l2lo
21┆ `cat ../chains/container-chains/runtime-
templates/${runtimeName.split("-template")[0]}/src/lib.rs | grep 'spec_version: [0-9]*' |
tail -1`
⋮┆----------------------------------------
33┆ `cat ../chains/orchestrator-relays/runtime/${runtimeName}/src/lib.rs | grep 'spec_version:
[0-9]*' | tail -1`
⋮┆----------------------------------------
45┆ `cat ../chains/orchestrator-paras/runtime/${runtimeName}/src/lib.rs | grep 'spec_version:
[0-9]*' | tail -1`
tools/github/github-utils.ts
❯❯❱ javascript.lang.security.detect-child-process.detect-child-process
Detected calls to child_process from a function argument `packageName`. This could lead to a command
injection if the input is user controllable. Try to avoid calls to child_process, and if it is
needed ensure user input is correctly sanitized or sandboxed.
Details: https://sg.run/l2lo
10┆ `git show ${previousTag}:../Cargo.lock | grep ${packageName}? | head -1 | grep -o '".*"'`
⋮┆----------------------------------------
❯❯❱ javascript.lang.security.detect-child-process.detect-child-process
Detected calls to child_process from a function argument `previousTag`. This could lead to a command
injection if the input is user controllable. Try to avoid calls to child_process, and if it is
needed ensure user input is correctly sanitized or sandboxed.
Details: https://sg.run/l2lo
10┆ `git show ${previousTag}:../Cargo.lock | grep ${packageName}? | head -1 | grep -o '".*"'`
⋮┆----------------------------------------
❯❯❱ javascript.lang.security.detect-child-process.detect-child-process
Detected calls to child_process from a function argument `newTag`. This could lead to a command
injection if the input is user controllable. Try to avoid calls to child_process, and if it is
needed ensure user input is correctly sanitized or sandboxed.
Details: https://sg.run/l2lo
16┆ `git show ${newTag}:../Cargo.lock | grep ${packageName}? | head -1 | grep -o '".*"'`
⋮┆----------------------------------------
❯❯❱ javascript.lang.security.detect-child-process.detect-child-process
Detected calls to child_process from a function argument `packageName`. This could lead to a command
injection if the input is user controllable. Try to avoid calls to child_process, and if it is
needed ensure user input is correctly sanitized or sandboxed.
Details: https://sg.run/l2lo
16┆ `git show ${newTag}:../Cargo.lock | grep ${packageName}? | head -1 | grep -o '".*"'`Metadata
Metadata
Assignees
Labels
No labels