Skip to content

fix(checker): add committer fields to dangerous workflow contex#4974

Closed
LoveChauhan-18 wants to merge 2 commits intoossf:mainfrom
LoveChauhan-18:fix/issue-4926-dangerous-workflow
Closed

fix(checker): add committer fields to dangerous workflow contex#4974
LoveChauhan-18 wants to merge 2 commits intoossf:mainfrom
LoveChauhan-18:fix/issue-4926-dangerous-workflow

Conversation

@LoveChauhan-18
Copy link
Copy Markdown

What kind of change does this PR introduce?

Bug fix

What is the current behavior?

The dangerous workflow check (containsUntrustedContextPattern) does not flag committer.name and committer.email from GitHub webhooks as untrusted. These fields can be easily controlled by attackers.

What is the new behavior (if this is a feature change)?**

Added committer.email and committer.name for both the head_commit and commits.* objects directly into the untrusted context regex.

  • Tests for the changes have been added (for bug fixes/features)

Which issue(s) this PR fixes

Fixes #4926

Special notes for your reviewer

Added the missing fields to the regex alongside the existing author checks and updated the dangerous_workflow_test.go fixture table with the corresponding cases.

Does this PR introduce a user-facing change?

No

NONE

…exts

Signed-off-by: Love Kumar Chauhan <lovechauhan6564@gmail.com>
@LoveChauhan-18 LoveChauhan-18 requested a review from a team as a code owner March 23, 2026 06:18
@LoveChauhan-18 LoveChauhan-18 requested review from AdamKorcz and justaugustus and removed request for a team March 23, 2026 06:18
@dosubot dosubot bot added the size:S This PR changes 10-29 lines, ignoring generated files. label Mar 23, 2026
@justaugustus
Copy link
Copy Markdown
Member

justaugustus commented Mar 23, 2026

@LoveChauhan-18 — While we are happy to consider contributions from new contributors, this is the second time you've opened a PR:

I am closing this PR and issuing a warning: please do not do this again

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

size:S This PR changes 10-29 lines, ignoring generated files.

Projects

Status: Done

Development

Successfully merging this pull request may close these issues.

BUG

2 participants