Skip to content

Commit 551df2b

Browse files
github-actions[bot]Copilot
github-actions[bot]
and
Copilot
authored
Audit-only threat spec review: 2026-09-13 daily optimizer run
Reviewed recent compiler changes and open code-scanning alerts against compiler-threat-detection-spec.md conformance scope. No new CTR-* rule was warranted; all reviewed findings are already-covered classes, out-of-scope files, stale/false-positive claims, or non-security smoke-test noise. Add Section 7.4 Mapping Audit (2026-09-13) recording: - #681/#678/#676/#675 (go/allocation-size-overflow): same in-process, schema-bounded capacity-hint class already assessed 2026-09-09/10. - #679 (go/useless-assignment-to-field), #674/#669/#668/#667 (go/bad-redirect-check): pkg/cli/ findings outside conformance scope. - #663 (js/http-to-file-access): scripts/ build tooling, out of scope, already carries an in-code CodeQL suppression rationale comment. - #652/#651 (workflow-go-graphql-injection-sprintf): stale against current pkg/cli/project_command.go, which already passes owner via GraphQL named variables, not fmt.Sprintf string interpolation. - #657 (workflow-security-finding-1): explicit smoke-test dummy alert. - #680 (workflow-out-of-context): stray commit artifacts (test_dup_import binary, tmp/smoke_test_22524436360.go, {outname}.f) — commit hygiene, not a compiler threat-detection gap. Bump spec to 1.0.35 with Section 2 sync-table row and Section 10 change-log entry (audit-only, no CTR rule or lock-file change). Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
1 parent 0489fac commit 551df2b

1 file changed

Lines changed: 18 additions & 1 deletion

File tree

‎specs/compiler-threat-detection-spec.md‎

Lines changed: 18 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -7,7 +7,7 @@ sidebar:
77

88
# GitHub Actions Compiler Threat Detection Specification
99

10-
**Version**: 1.0.34
10+
**Version**: 1.0.35
1111
**Status**: Candidate Recommendation
1212
**Latest Version**: https://github.com/github/gh-aw/blob/main/specs/compiler-threat-detection-spec.md
1313
**Editors**: GitHub Next (GitHub, Inc.)
@@ -32,6 +32,7 @@ Each version maps to the minimum compatible binary. A version change MUST update
3232

3333
| Versions | Minimum gh-aw | Compatibility |
3434
|---|---:|---|
35+
| `1.0.35` | `v0.87.9` | Audit-only; #681/#678/#676/#675, #679, #674/#669/#668/#667, #663, #657, #652/#651, and #680 are not new threat classes. |
3536
| `1.0.34` | `v0.87.9` | Adds CTR-027; allowlisted bot synchronization requires trusted same-repository provenance. |
3637
| `1.0.33` | `v0.87.9` | Audit-only; no new CTR rule or lock-file schema change. |
3738
| `1.0.32` | `v0.87.9` | Audit-only; no new CTR rule or lock-file schema change. |
@@ -154,6 +155,21 @@ Every active rule MUST map to implementation and test coverage. References are p
154155
| CTR-026 Generated Job Timeout Expression Injection | custom-job properties and timeout resolution | custom-job and timeout tests |
155156
| CTR-027 Allowlisted Bot Synchronization Provenance | `actions/setup/js/check_membership.cjs`, `actions/setup/js/check_permissions_utils.cjs` | `actions/setup/js/check_membership.test.cjs`, `actions/setup/js/check_permissions_utils.test.cjs` |
156157

158+
### 7.4 Mapping Audit (2026-09-13)
159+
160+
No compiler/parser source diff exists beyond the single squashed commit state (`0489fac`, "Share API rate-limit state across multi-target logs downloads", #60531); no candidate threat surfaced from `pkg/workflow/`, `pkg/parser/`, or `actions/setup/` source changes in the review window.
161+
162+
Open high/critical code-scanning alerts were reviewed against conformance scope (Section 1):
163+
164+
- Alerts #681, #678, #676, #675 (`go/allocation-size-overflow` in `pkg/workflow/compiler_yaml_ai_execution.go`, `pkg/workflow/mcp_cli_mount.go`, `pkg/workflow/mcp_github_config.go`) are the same previously-assessed class of finding — `make([]T, 0, n+m)` capacity hints computed from in-process, already-bounded slice/map lengths (step lines, server-name lists, guard-policy counts), not attacker-controlled magnitudes. No CTR rule applies; consistent with the 2026-09-09/2026-09-10 disposition for this alert class.
165+
- Alert #679 (`go/useless-assignment-to-field` in `pkg/cli/logs_orchestrator_stdin.go`) and alerts #674, #669, #668, #667 (`go/bad-redirect-check` in `pkg/cli/*.go`, `pkg/workflow/graders_config.go`) are code-quality/heuristic-mismatch findings in `pkg/cli/`, outside the `pkg/workflow/`/`pkg/parser/`/`actions/setup/` conformance scope in Section 1; the `bad-redirect-check` alerts recur the 2026-09-10 audit's path-containment-guard disposition.
166+
- Alert #663 (`js/http-to-file-access` in `scripts/ensure-docs-slide-pdf.js`) is outside conformance scope (build tooling, not compiler/parser/setup) and already carries an in-code CodeQL suppression comment explaining the fixed-URL, validated-content-type, signature-checked download path.
167+
- Alerts #652/#651 (`workflow-go-graphql-injection-sprintf`, Semgrep) target `pkg/cli/project_command.go` lines 269/272 from an earlier commit (`f5d0fffd`). The current file has no `fmt.Sprintf`-built GraphQL query for the `owner` parameter; `validateOwner`/`getOwnerNodeId` pass `owner` through `runProjectGraphQLQueryWithVariables(..., map[string]any{"login": owner})` using named GraphQL variables, and no `escapeGraphQLString` function exists anywhere in the repository. The finding is stale against current source and also outside `pkg/cli/` conformance scope; no CTR rule applies.
168+
- Alert #657 (`workflow-security-finding-1`) is an explicit smoke-test dummy warning ("Smoke test dummy warning — Run 34294409797") from the `smoke-claude` workflow, not a real finding.
169+
- Alert #680 (`workflow-out-of-context`) flags three files unexpectedly committed in `0489fac`: `test_dup_import` (a 2.3 MB compiled Go ELF binary), `tmp/smoke_test_22524436360.go` (a leftover smoke-test placeholder marked "can be safely removed" in its own header comment), and `{outname}.f` (an empty file with an unresolved template variable name). None of the three are referenced by any build script, Go import, or workflow, and the scanner rates them Low (3/10) as out-of-context artifacts rather than a compiler-generated-workflow threat; they represent stray commit hygiene, not a `CTR-*` detection gap, so no rule change applies. Removal is a housekeeping action outside this specification's scope (compiler rule catalog), not a threat-detection rule.
170+
171+
No live `threat-detection-suppress` annotation exists in any workflow frontmatter (only illustrative documentation examples), so no `SLA_BREACH` applies.
172+
157173
### 7.3 Mapping Audit (2026-09-11)
158174

159175
Issue #59894 (`[sighthound] Security findings in github/gh-aw`) reported a Critical CWE-78 command-injection finding claiming untrusted `commentBody`/`params` reach `exec` in `actions/setup/js/close_issue.cjs` (and a `pkg/workflow/js/close_issue.cjs` mirror) around lines 5 and 1110. Verification against conformance scope found this to be a false positive: `close_issue.cjs` is 402 lines total (no line 1110 exists), contains no `exec`/`child_process`/`spawn` call anywhere, and `pkg/workflow/js/close_issue.cjs` does not exist in the repository. `commentBody` in `close_entity_helpers.cjs` flows only into the authenticated GitHub API client (`callbacks.addComment`), never into a shell or subprocess argument, so CTR-006 (Template Injection) and CTR-013 (Argument Injection via Package/Image Names) triggers do not apply and no new `CTR-*` rule is warranted. No `threat-detection-suppress` annotation was added because the finding does not correspond to any real code path the compiler needs to suppress — it is an inapplicable external scan result about nonexistent code, not an active false-positive-prone compiler rule.
@@ -229,6 +245,7 @@ A test ID that is deprecated under Section 5.4 MUST remain listed in Section 8.1
229245

230246
| Version | Change |
231247
|---|---|
248+
| 1.0.35 | Audit-only review; open code-scanning alerts (#681/#678/#676/#675 allocation-overflow, #679 useless-assignment, #674/#669/#668/#667 bad-redirect-check, #663 http-to-file-access, #657 smoke-test dummy, #652/#651 stale GraphQL-injection claim, #680 out-of-context stray commit artifacts) are not new compiler threat classes. |
232249
| 1.0.34 | Added CTR-027 for trusted same-repository allowlisted bot synchronization and fail-closed confused-deputy handling. |
233250
| 1.0.33 | Audit-only review; issue #59894's `close_issue.cjs` command-injection claim is a false positive (no `exec`/subprocess call exists in the file). |
234251
| 1.0.32 | Audit-only review; #675–677 and #667–669/#674 are not new threat classes. |

0 commit comments

Comments
 (0)