Skip to content

Commit 016cabf

Browse files
aleksandra-bozhinoska-sonarsourcealeksandra-bozhinoska-sonarsource
committed
SQSCANGHA-101 Add more command injection tests
1 parent 5fc8cfc commit 016cabf

File tree

4 files changed

+109
-8
lines changed

4 files changed

+109
-8
lines changed

‎.github/workflows/qa-main.yml‎

Lines changed: 90 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -41,20 +41,22 @@ jobs:
4141
- name: Run action with args
4242
uses: ./
4343
with:
44-
args: -Dsonar.someArg=aValue -Dsonar.anotherArgWithSpaces="Another Value"
44+
args: -Dsonar.someArg=aValue -Dsonar.anotherArgWithSpaces="Another Value" -Dsonar.argWithSingleQuotes='Another Value'
4545
env:
4646
SONAR_HOST_URL: http://not_actually_used
4747
SONAR_SCANNER_JSON_PARAMS: '{"sonar.scanner.internal.dumpToFile": "./output.properties"}'
4848
- name: Assert
4949
run: |
5050
./test/assertFileContains ./output.properties "sonar.someArg=aValue"
51-
./test/assertFileContains ./output.properties "sonar.anotherArgWithSpaces=Another Value"
51+
./test/assertFileContains ./output.properties 'sonar.anotherArgWithSpaces="Another Value"'
52+
./test/assertFileContains ./output.properties "sonar.argWithSingleQuotes='Another Value'"
5253
argsInputInjectionTest:
5354
name: >
5455
'args' input with command injection will fail
5556
strategy:
5657
matrix:
5758
os: [ ubuntu-latest-large, windows-latest-large, macos-latest ]
59+
args: [ -Dsonar.someArg=aValue && echo "Injection", -Dsonar.someArg="value\"; whoami; echo \"" ]
5860
runs-on: ${{ matrix.os }}
5961
steps:
6062
- uses: actions/checkout@v5
@@ -64,7 +66,7 @@ jobs:
6466
uses: ./
6567
continue-on-error: true
6668
with:
67-
args: -Dsonar.someArg=aValue && echo "Injection"
69+
args: ${{ matrix.args }}
6870
env:
6971
SONAR_HOST_URL: http://not_actually_used
7072
SONAR_SCANNER_JSON_PARAMS: '{"sonar.scanner.internal.dumpToFile": "./output.properties"}'
@@ -74,6 +76,91 @@ jobs:
7476
- name: Assert the scanner was not called
7577
run: |
7678
./test/assertFileDoesntExist ./output.properties
79+
backtickCommandInjectionTest:
80+
name: >
81+
'args' input with backticks injection does not execute command
82+
strategy:
83+
matrix:
84+
os: [ ubuntu-latest-large, windows-latest-large, macos-latest ]
85+
runs-on: ${{ matrix.os }}
86+
steps:
87+
- uses: actions/checkout@v5
88+
with:
89+
token: ${{ secrets.GITHUB_TOKEN }}
90+
- name: Run action with args
91+
uses: ./
92+
continue-on-error: true
93+
with:
94+
args: >
95+
-Dsonar.arg1="refs/heads/branch: [workflows] Bump `actions/*`" -Dsonar.arg2="test `echo Command Injection`" -Dsonar.arg3="`id`" -Dsonar.arg4="test'; `echo injection`; echo '" -Dsonar.arg5=" `whoami` " -Dsonar.arg6="test\`echo injection\`test"
96+
env:
97+
SONAR_HOST_URL: http://not_actually_used
98+
SONAR_SCANNER_JSON_PARAMS: '{"sonar.scanner.internal.dumpToFile": "./output.properties"}'
99+
- name: Assert command in arg is not executed
100+
run: |
101+
./test/assertFileContains ./output.properties 'sonar.arg1="refs/heads/branch\\: \[workflows\] Bump `actions/\*`"'
102+
./test/assertFileContains ./output.properties 'sonar.arg2="test `echo Command Injection`"'
103+
./test/assertFileContains ./output.properties 'sonar.arg3="`id`"'
104+
./test/assertFileContains ./output.properties "sonar.arg4=\"test'; \`echo injection\`; echo '\""
105+
./test/assertFileContains ./output.properties 'sonar.arg5=" `whoami` "'
106+
./test/assertFileContains ./output.properties 'sonar.arg6="test\\\\`echo injection\\\\`test"'
107+
dollarSymbolCommandInjectionTest:
108+
name: >
109+
'args' input with dollar command injection does not execute command
110+
strategy:
111+
matrix:
112+
os: [ ubuntu-latest-large, windows-latest-large, macos-latest ]
113+
runs-on: ${{ matrix.os }}
114+
steps:
115+
- uses: actions/checkout@v5
116+
with:
117+
token: ${{ secrets.GITHUB_TOKEN }}
118+
- name: Run action with args
119+
uses: ./
120+
continue-on-error: true
121+
with:
122+
args: -Dsonar.arg1="$(whoami)" -Dsonar.arg2="$GITHUB_TOKEN" -Dsonar.arg3="$(echo outer $(echo inner))" -Dsonar.arg4="value\$(whoami)end" -Dsonar.arg5="$(printf 'A%.0s' {1..10000})" -Dsonar.arg6='value"; $(whoami); echo "'
123+
env:
124+
SONAR_HOST_URL: http://not_actually_used
125+
SONAR_SCANNER_JSON_PARAMS: '{"sonar.scanner.internal.dumpToFile": "./output.properties"}'
126+
- name: Assert command in arg is not executed
127+
run: |
128+
./test/assertFileContains ./output.properties 'sonar.arg1="$(whoami)"'
129+
./test/assertFileContains ./output.properties 'sonar.arg2="$GITHUB_TOKEN"'
130+
./test/assertFileContains ./output.properties 'sonar.arg3="$(echo outer $(echo inner))"'
131+
./test/assertFileContains ./output.properties 'sonar.arg4="value\\\\$(whoami)end"'
132+
./test/assertFileContains ./output.properties 'sonar.arg5="$(printf '\''A%.0s'\'' {1..10000})"'
133+
./test/assertFileContains ./output.properties 'sonar.arg6='\''value"; $(whoami); echo "'\'''
134+
otherCommandInjectionVariantsTest:
135+
name: >
136+
'args' input with other command injection variants does not execute command
137+
strategy:
138+
matrix:
139+
os: [ ubuntu-latest-large, windows-latest-large, macos-latest ]
140+
runs-on: ${{ matrix.os }}
141+
steps:
142+
- uses: actions/checkout@v5
143+
with:
144+
token: ${{ secrets.GITHUB_TOKEN }}
145+
- name: Run action with args
146+
uses: ./
147+
continue-on-error: true
148+
with:
149+
args: -Dsonar.arg1="test | base64" -Dsonar.arg2="value; whoami" -Dsonar.arg3="value && echo test" -Dsonar.arg4="value > /tmp/output.txt" -Dsonar.arg5="< /etc/passwd" -Dsonar.arg6="" -Dsonar.arg7="../../../*" -Dsonar.arg8="*.key" -Dsonar.arg9="test\u0027\u0060whoami\u0060"
150+
env:
151+
SONAR_HOST_URL: http://not_actually_used
152+
SONAR_SCANNER_JSON_PARAMS: '{"sonar.scanner.internal.dumpToFile": "./output.properties"}'
153+
- name: Assert command in arg is not executed
154+
run: |
155+
./test/assertFileContains ./output.properties 'sonar.arg1="test | base64"'
156+
./test/assertFileContains ./output.properties 'sonar.arg2="value; whoami"'
157+
./test/assertFileContains ./output.properties 'sonar.arg3="value && echo test"'
158+
./test/assertFileContains ./output.properties 'sonar.arg4="value > /tmp/output.txt"'
159+
./test/assertFileContains ./output.properties 'sonar.arg5="< /etc/passwd"'
160+
./test/assertFileContains ./output.properties 'sonar.arg6=""'
161+
./test/assertFileContains ./output.properties 'sonar.arg7="../../../\*"'
162+
./test/assertFileContains ./output.properties 'sonar.arg8="\*.key"'
163+
./test/assertFileContains ./output.properties 'sonar.arg9="test\\\\u0027\\\\u0060whoami\\\\u0060"'
77164
projectBaseDirInputTest:
78165
name: >
79166
'projectBaseDir' input

‎action.yml‎

Lines changed: 2 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -51,11 +51,9 @@ runs:
5151
run: echo "${RUNNER_TEMP}/sonar-scanner-cli-${{ inputs.scannerVersion }}-${{ runner.os }}-${{ runner.arch }}/bin" >> $GITHUB_PATH
5252
shell: bash
5353
- name: Run SonarScanner
54-
run: |
55-
args=(${{ inputs.args }})
56-
cmd=(${GITHUB_ACTION_PATH}/scripts/run-sonar-scanner-cli.sh "${args[@]}")
57-
"${cmd[@]}"
54+
run: ${GITHUB_ACTION_PATH}/scripts/run-sonar-scanner.sh
5855
shell: bash
5956
env:
57+
INPUT_ARGS: ${{ inputs.args }}
6058
INPUT_PROJECTBASEDIR: ${{ inputs.projectBaseDir }}
6159
SONAR_SCANNER_JRE: ${{ runner.temp }}/sonar-scanner-cli-${{ inputs.scannerVersion }}-${{ runner.os }}-${{ runner.arch }}/jre

‎scripts/run-sonar-scanner-cli.sh‎

Lines changed: 11 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -73,7 +73,17 @@ if [[ -n "${SONAR_ROOT_CERT}" ]]; then
7373
scanner_args+=("-Dsonar.scanner.truststorePassword=$SONAR_SSL_TRUSTSTORE_PASSWORD")
7474
fi
7575

76-
scanner_args+=("$@")
76+
# split input args correctly (passed through INPUT_ARGS env var to avoid execution of injected command)
77+
args=()
78+
if [[ -n "${INPUT_ARGS}" ]]; then
79+
# the regex recognizes args with values in single or double quotes (without character escaping), and args without quotes as well
80+
# more specifically, the following patterns: -Darg="value", -Darg='value', -Darg=value, "-Darg=value" and '-Darg=value'
81+
IFS=$'\n'; args=($(echo ${INPUT_ARGS} | egrep -o '[^" '\'']+="[^"]*"|[^" '\'']+='\''[^'\'']*'\''|[^" '\'']+|"[^"]+"|'\''[^'\'']+'\'''))
82+
fi
83+
84+
for arg in "${args[@]}"; do
85+
scanner_args+=("$arg")
86+
done
7787

7888
set -ux
7989

‎scripts/run-sonar-scanner.sh‎

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,6 @@
1+
#!/usr/bin/env bash
2+
set -euo pipefail
3+
4+
# run the sonar scanner cli
5+
cmd=(${GITHUB_ACTION_PATH}/scripts/run-sonar-scanner-cli.sh "${INPUT_ARGS}")
6+
"${cmd[@]}"

0 commit comments

Comments
 (0)