Here’s the translation into American English:
—
Security has become an essential aspect of software development, and implementing it from the beginning of a project proves to be more effective than trying to incorporate it at the end. In this context, GitHub Actions injections stand out as one of the most common vulnerabilities in projects stored in repositories on this platform. Fortunately, it is a relatively straightforward issue to address, and GitHub provides tools that facilitate its management.
Adopting a security mindset is crucial. Security in software is not a task that is ever truly finished; rather, it is a continuous process that must be constantly reviewed. Although automated tools are very helpful, they are not a foolproof solution. It is vital to understand the causes of vulnerabilities in order to effectively address them.
GitHub Actions injections occur when a malicious attacker is able to send a command that is executed within the workflow of a repository. This can happen when the attacker controls data, such as the title of an issue or the name of a branch, which is then executed without validation. A typical example is using specific syntax in the code that can be manipulated to insert malicious commands. An attack could be carried out simply by creating an issue title that contains harmful code, which would run with the same permissions as the workflow.
To proactively protect the code, it is vital to adopt certain practices. One recommendation is to use environment variables instead of directly employing untrusted data. Avoiding expansive syntax in execution sections helps minimize risks. Another strategy is to apply the principle of least privilege, ensuring that workflows operate with only the necessary permissions.
It is also essential to handle pull_request_target triggers with caution, as they represent a greater risk compared to pull_request triggers. The ramifications of improper use could open security gaps that an attacker could exploit.
With GitHub’s CodeQL tool, automated security analysis is facilitated, allowing for the identification of vulnerabilities within the code, including detecting risks from injections in GitHub Actions. This tool follows a tracking process that simplifies the identification of untrusted data flows, helping developers ensure that their code is more secure. Additionally, implementing code analysis is a straightforward process that can be done on any protected branch of the repository.
In summary, although injections in GitHub Actions are a common problem, they can be addressed with appropriate preventive measures and the use of available tools. The key lies in awareness and constant code analysis to identify potential weak points, which will enable the development of safer software in the future.
Referrer: MiMub in Spanish
