fix(cache-poisoning): evaluate certain cache control expressions#1954
fix(cache-poisoning): evaluate certain cache control expressions#1954woodruffw merged 12 commits intozizmorcore:mainfrom
Conversation
reubenwong97
force-pushed
the
feat/coordinate-extras
branch
from
be00505 to
120e410
Compare
|
Hi @woodruffw , Can you help to take a look at this when you have time? This is one of the fixes I'm less confident about in my approach.. Broadly speaking I attempted to parse the inner expression into nodes that we recognize and are relevant (in this specific case, it is very targeted to I am also not too pleased with the many Thank you! |
|
Thanks @reubenwong97, I'll be able to review this in the next day or so. |
woodruffw
left a comment
woodruffw
left a comment
There was a problem hiding this comment.
Thanks @reubenwong97! This approach looks good to me overall, I'm just going to push some tweaks + docs.
Signed-off-by: William Woodruff <[email protected]>
Signed-off-by: William Woodruff <[email protected]>
Signed-off-by: William Woodruff <[email protected]>
Signed-off-by: William Woodruff <[email protected]>
Signed-off-by: William Woodruff <[email protected]>
Signed-off-by: William Woodruff <[email protected]>
woodruffw
force-pushed
the
feat/coordinate-extras
branch
from
aafc8ce to
fa3cb63
Compare
Signed-off-by: William Woodruff <[email protected]>
Signed-off-by: William Woodruff <[email protected]>
Signed-off-by: William Woodruff <[email protected]>
Signed-off-by: William Woodruff <[email protected]>
woodruffw
left a comment
woodruffw
left a comment
There was a problem hiding this comment.
Thanks @reubenwong97! I think there's a lot of other heuristics we could apply here over time (like for other triggers), but this is a great foundation.
2 participants
Pre-submission checks
Please check these boxes:
Mandatory: This PR corresponds to an issue [BUG]: zizmor currently flags maturin's generated workflow for
sccache: ${{ !startsWith(github.ref, 'refs/tags/') }}being vulnerable to a cache poisoning attack #1940 .Having read the AI policy, I hereby disclose the use of an LLM or other
AI coding assistant in the creation of this PR. PRs will not be rejected
for using AI tools, but will be rejected for undisclosed use or
use that violates the policy.
If a checkbox is not applicable, you can leave it unchecked.
Summary
Parses known patterns in cache control expressions to determine if cache is enabled.
Test Plan
Issue reproduction integration test.
Closes #1940