Skip to content

Commit 67117d0

Browse files
aleksandra-bozhinoska-sonarsourcealeksandra-bozhinoska-sonarsource
committed
SQSCANGHA-101 Add more injection tests
1 parent 85ee78f commit 67117d0

4 files changed

Lines changed: 133 additions & 8 deletions

File tree

‎.github/workflows/qa-main.yml‎

Lines changed: 114 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -41,15 +41,16 @@ jobs:
4141
- name: Run action with args
4242
uses: ./
4343
with:
44-
args: -Dsonar.someArg=aValue -Dsonar.anotherArgWithSpaces="Another Value"
44+
args: -Dsonar.someArg=aValue -Dsonar.anotherArgWithSpaces="Another Value" -Dsonar.argWithSingleQuotes='Another Value'
4545
env:
4646
SONAR_HOST_URL: http://not_actually_used
4747
SONAR_SCANNER_JSON_PARAMS: '{"sonar.scanner.internal.dumpToFile": "./output.properties"}'
4848
- name: Assert
4949
run: |
5050
./test/assertFileContains ./output.properties "sonar.someArg=aValue"
51-
./test/assertFileContains ./output.properties "sonar.anotherArgWithSpaces=Another Value"
52-
argsInputInjectionTest:
51+
./test/assertFileContains ./output.properties 'sonar.anotherArgWithSpaces="Another Value"'
52+
./test/assertFileContains ./output.properties "sonar.argWithSingleQuotes='Another Value'"
53+
argsInputInjectionTest1:
5354
name: >
5455
'args' input with command injection will fail
5556
strategy:
@@ -74,6 +75,116 @@ jobs:
7475
- name: Assert the scanner was not called
7576
run: |
7677
./test/assertFileDoesntExist ./output.properties
78+
argsInputInjectionTest2:
79+
name: >
80+
'args' input with command injection will fail
81+
strategy:
82+
matrix:
83+
os: [ ubuntu-latest-large, windows-latest-large, macos-latest ]
84+
runs-on: ${{ matrix.os }}
85+
steps:
86+
- uses: actions/checkout@v5
87+
with:
88+
token: ${{ secrets.GITHUB_TOKEN }}
89+
- name: Run action with args
90+
uses: ./
91+
continue-on-error: true
92+
with:
93+
args: -Dsonar.arg1="value\"; whoami; echo \""
94+
env:
95+
SONAR_HOST_URL: http://not_actually_used
96+
SONAR_SCANNER_JSON_PARAMS: '{"sonar.scanner.internal.dumpToFile": "./output.properties"}'
97+
- name: Fail if action succeeded
98+
if: steps.runTest.outcome == 'success'
99+
run: exit 1
100+
- name: Assert the scanner was not called
101+
run: |
102+
./test/assertFileDoesntExist ./output.properties
103+
backtickCommandInjectionTest:
104+
name: >
105+
'args' input with backticks injection does not execute command
106+
strategy:
107+
matrix:
108+
os: [ ubuntu-latest-large, windows-latest-large, macos-latest ]
109+
runs-on: ${{ matrix.os }}
110+
steps:
111+
- uses: actions/checkout@v5
112+
with:
113+
token: ${{ secrets.GITHUB_TOKEN }}
114+
- name: Run action with args
115+
uses: ./
116+
continue-on-error: true
117+
with:
118+
args: >
119+
-Dsonar.arg1="refs/heads/branch: [workflows] Bump `actions/*`" -Dsonar.arg2="test `echo Command Injection`" -Dsonar.arg3="`id`" -Dsonar.arg4="test'; `echo injection`; echo '" -Dsonar.arg5=" `whoami` " -Dsonar.arg6="test\`echo injection\`test"
120+
env:
121+
SONAR_HOST_URL: http://not_actually_used
122+
SONAR_SCANNER_JSON_PARAMS: '{"sonar.scanner.internal.dumpToFile": "./output.properties"}'
123+
- name: Assert command in arg is not executed
124+
run: |
125+
./test/assertFileContains ./output.properties 'sonar.arg1="refs/heads/branch\\: \[workflows\] Bump `actions/\*`"'
126+
./test/assertFileContains ./output.properties 'sonar.arg2="test `echo Command Injection`"'
127+
./test/assertFileContains ./output.properties 'sonar.arg3="`id`"'
128+
./test/assertFileContains ./output.properties "sonar.arg4=\"test'; \`echo injection\`; echo '\""
129+
./test/assertFileContains ./output.properties 'sonar.arg5=" `whoami` "'
130+
./test/assertFileContains ./output.properties 'sonar.arg6="test\\\\`echo injection\\\\`test"'
131+
dollarSymbolCommandInjectionTest:
132+
name: >
133+
'args' input with dollar command injection does not execute command
134+
strategy:
135+
matrix:
136+
os: [ ubuntu-latest-large, windows-latest-large, macos-latest ]
137+
runs-on: ${{ matrix.os }}
138+
steps:
139+
- uses: actions/checkout@v5
140+
with:
141+
token: ${{ secrets.GITHUB_TOKEN }}
142+
- name: Run action with args
143+
uses: ./
144+
continue-on-error: true
145+
with:
146+
args: -Dsonar.arg1="$(whoami)" -Dsonar.arg2="$GITHUB_TOKEN" -Dsonar.arg3="$(echo outer $(echo inner))" -Dsonar.arg4="value\$(whoami)end" -Dsonar.arg5="$(printf 'A%.0s' {1..10000})" -Dsonar.arg6='value"; $(whoami); echo "'
147+
env:
148+
SONAR_HOST_URL: http://not_actually_used
149+
SONAR_SCANNER_JSON_PARAMS: '{"sonar.scanner.internal.dumpToFile": "./output.properties"}'
150+
- name: Assert command in arg is not executed
151+
run: |
152+
./test/assertFileContains ./output.properties 'sonar.arg1="$(whoami)"'
153+
./test/assertFileContains ./output.properties 'sonar.arg2="$GITHUB_TOKEN"'
154+
./test/assertFileContains ./output.properties 'sonar.arg3="$(echo outer $(echo inner))"'
155+
./test/assertFileContains ./output.properties 'sonar.arg4="value\\\\$(whoami)end"'
156+
./test/assertFileContains ./output.properties 'sonar.arg5="$(printf '\''A%.0s'\'' {1..10000})"'
157+
./test/assertFileContains ./output.properties 'sonar.arg6='\''value"; $(whoami); echo "'\'''
158+
otherCommandInjectionVariantsTest:
159+
name: >
160+
'args' input with other command injection variants does not execute command
161+
strategy:
162+
matrix:
163+
os: [ ubuntu-latest-large, windows-latest-large, macos-latest ]
164+
runs-on: ${{ matrix.os }}
165+
steps:
166+
- uses: actions/checkout@v5
167+
with:
168+
token: ${{ secrets.GITHUB_TOKEN }}
169+
- name: Run action with args
170+
uses: ./
171+
continue-on-error: true
172+
with:
173+
args: -Dsonar.arg1="test | base64" -Dsonar.arg2="value; whoami" -Dsonar.arg3="value && echo test" -Dsonar.arg4="value > /tmp/output.txt" -Dsonar.arg5="< /etc/passwd" -Dsonar.arg6="" -Dsonar.arg7="../../../*" -Dsonar.arg8="*.key" -Dsonar.arg9="test\u0027\u0060whoami\u0060"
174+
env:
175+
SONAR_HOST_URL: http://not_actually_used
176+
SONAR_SCANNER_JSON_PARAMS: '{"sonar.scanner.internal.dumpToFile": "./output.properties"}'
177+
- name: Assert command in arg is not executed
178+
run: |
179+
./test/assertFileContains ./output.properties 'sonar.arg1="test | base64"'
180+
./test/assertFileContains ./output.properties 'sonar.arg2="value; whoami"'
181+
./test/assertFileContains ./output.properties 'sonar.arg3="value && echo test"'
182+
./test/assertFileContains ./output.properties 'sonar.arg4="value > /tmp/output.txt"'
183+
./test/assertFileContains ./output.properties 'sonar.arg5="< /etc/passwd"'
184+
./test/assertFileContains ./output.properties 'sonar.arg6=""'
185+
./test/assertFileContains ./output.properties 'sonar.arg7="../../../\*"'
186+
./test/assertFileContains ./output.properties 'sonar.arg8="\*.key"'
187+
./test/assertFileContains ./output.properties 'sonar.arg9="test\\\\u0027\\\\u0060whoami\\\\u0060"'
77188
projectBaseDirInputTest:
78189
name: >
79190
'projectBaseDir' input

‎action.yml‎

Lines changed: 2 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -51,11 +51,9 @@ runs:
5151
run: echo "${RUNNER_TEMP}/sonar-scanner-cli-${{ inputs.scannerVersion }}-${{ runner.os }}-${{ runner.arch }}/bin" >> $GITHUB_PATH
5252
shell: bash
5353
- name: Run SonarScanner
54-
run: |
55-
args=(${{ inputs.args }})
56-
cmd=(${GITHUB_ACTION_PATH}/scripts/run-sonar-scanner-cli.sh "${args[@]}")
57-
"${cmd[@]}"
54+
run: ${GITHUB_ACTION_PATH}/scripts/run-sonar-scanner.sh
5855
shell: bash
5956
env:
57+
INPUT_ARGS: ${{ inputs.args }}
6058
INPUT_PROJECTBASEDIR: ${{ inputs.projectBaseDir }}
6159
SONAR_SCANNER_JRE: ${{ runner.temp }}/sonar-scanner-cli-${{ inputs.scannerVersion }}-${{ runner.os }}-${{ runner.arch }}/jre

‎scripts/run-sonar-scanner-cli.sh‎

Lines changed: 11 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -73,7 +73,17 @@ if [[ -n "${SONAR_ROOT_CERT}" ]]; then
7373
scanner_args+=("-Dsonar.scanner.truststorePassword=$SONAR_SSL_TRUSTSTORE_PASSWORD")
7474
fi
7575

76-
scanner_args+=("$@")
76+
# split input args correctly (passed through INPUT_ARGS env var to avoid execution of injected command)
77+
args=()
78+
if [[ -n "${INPUT_ARGS}" ]]; then
79+
# the regex recognizes args with values in single or double quotes (without character escaping), and args without quotes as well
80+
# more specifically, the following patterns: -Darg="value", -Darg='value', -Darg=value, "-Darg=value" and '-Darg=value'
81+
IFS=$'\n'; args=($(echo ${INPUT_ARGS} | egrep -o '[^" '\'']+="[^"]*"|[^" '\'']+='\''[^'\'']*'\''|[^" '\'']+|"[^"]+"|'\''[^'\'']+'\'''))
82+
fi
83+
84+
for arg in "${args[@]}"; do
85+
scanner_args+=("$arg")
86+
done
7787

7888
set -ux
7989

‎scripts/run-sonar-scanner.sh‎

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,6 @@
1+
#!/usr/bin/env bash
2+
set -euo pipefail
3+
4+
# run the sonar scanner cli
5+
cmd=(${GITHUB_ACTION_PATH}/scripts/run-sonar-scanner-cli.sh "${INPUT_ARGS}")
6+
"${cmd[@]}"

0 commit comments

Comments
 (0)