Repository navigation
am-i-hacked 2.0.1: scanner hardening and scanning-alert fixes - #3
Merged
Merged
Conversation
Scanner: - Run git ls-files with core.fsmonitor disabled, so a scanned repo's .git/config cannot execute code. - Scan payloads in dot-directories, folders named by .ignore/.rgignore, and tracked files that .gitignore matches. - Scan extensionless scripts inside folders with a dot in their name. - Scan committed build output. Recognized bundles (ncc, webpack, esbuild) get only high-signal checks. - Verify official Yarn releases by sha256 against bin/yarn-releases.tsv, refreshed by scripts/update-yarn-releases.sh. - Exempt an embedded wasm data-URI line from the long-line check. CI and release: - Fix the unquoted expansion in scripts/release.sh (Semgrep). - Mark the pull_request_target checkout in gate.yml as reviewed. - Pin upload-sarif to the v4.38.2 release and the semgrep image to 1.178.0 by digest. Docs: README privacy note, CHANGELOG 2.0.1, version bump.
Fixes the Lint, format & tests check.
Owner
Author
|
@codeant review |
The workflow existed in the private repo but was never listed in scripts/public-paths.txt, so the public export left it out. Add it to the manifest. It still runs only when the CODEANT_ENABLED repository variable is true and the CODEANT_API_TOKEN secret is set.
Restore the Semgrep section, the mise gate and semgrep-strict tasks and the CodeAnt scan mention that the 2.0.0 README rewrite dropped. Add ROADMAP.md with the release scheme and the 2.1.0 candidates.
This branch was successfully deployed
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Release 2.0.1 of am-i-hacked: scanner hardening plus fixes for the open code-scanning alerts and Dependabot PR #1.
Scanner
git ls-filesnow runs withcore.fsmonitordisabled, so a scanned repo's.git/configcannot run code..ignore/.rgignore, and in tracked files that.gitignorematches are now scanned.bin/yarn-releases.tsv(refreshed byscripts/update-yarn-releases.sh).Code scanning and dependencies
unquoted-variable-expansion-in-commandinscripts/release.sh: fixed.pull-request-target-code-checkoutingate.yml: by design (the scanner only reads checked-out files), marked with a reasonednosemgrepcomment.github/codeql-action/upload-sarifpinned to thev4.38.2release commit with a version comment, so Dependabot proposes tagged releases. This supersedes Dependabot PR Bump github/codeql-action/upload-sarif from 9fddc16f0de775b9edd8a84dd5839ac2db070f8b to 61817fadad823920a8924645dd5f67985d6a1d94 #1, which proposed an untagged commit.semgrep/semgrepimage pinned to1.178.0by digest.Docs: README privacy note, CHANGELOG 2.0.1, version bump.
Test plan
bats testinapps/am-i-hacked: 318 tests pass, pending ones skipped.bash -nandshellcheckon the new script.