Skip to main content

Find dangerous GITHUB_ENV usage

org.openrewrite.github.security.GitHubEnvRecipe

Detects dangerous usage of GITHUB_ENV and GITHUB_PATH environment files in workflows with risky triggers like pull_request_target or workflow_run. Writing to these files can allow code injection when the content includes user-controlled data. Based on zizmor's github-env audit.

Recipe source​

GitHub, Issue Tracker, Maven Central

This recipe is available under the Moderne Source Available License.

Used by​

This recipe is used as part of the following composite recipes:

Example​

Before​
on: pull_request_target
jobs:
  test:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - name: Set environment
        run: |
          echo "BRANCH_NAME=${{ github.head_ref }}" >> $GITHUB_ENV
          echo "Building branch: $BRANCH_NAME"
After​
on: pull_request_target
jobs:
  test:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - name: Set environment
        ~~(Write to GITHUB_ENV may allow code execution in a workflow with dangerous triggers. This can lead to code injection when the written content includes user-controlled data. Ensure any dynamic content is properly sanitized or avoid writing to environment files in workflows triggered by untrusted events.)~~>run: |
          echo "BRANCH_NAME=${{ github.head_ref }}" >> $GITHUB_ENV
          echo "Building branch: $BRANCH_NAME"

Usage​

This recipe has no required configuration options. It can be activated by adding a dependency on org.openrewrite.recipe:rewrite-github-actions in your build file or by running a shell command (in which case no build changes are needed):

  1. Add the following to your build.gradle file:
build.gradle
plugins {
    id("org.openrewrite.rewrite") version("latest.release")
}

rewrite {
    activeRecipe("org.openrewrite.github.security.GitHubEnvRecipe")
    setExportDatatables(true)
}

repositories {
    mavenCentral()
}

dependencies {
    rewrite("org.openrewrite.recipe:rewrite-github-actions:3.11.0")
}
  1. Run gradle rewriteRun to run the recipe.

See how this recipe works across multiple open-source repositories​

Run this recipe on OSS repos at scale with the Moderne SaaS.

The community edition of the Moderne platform enables you to easily run recipes across thousands of open-source repositories.

Please contact Moderne for more information about safely running the recipes on your own codebase in a private SaaS.

Data Tables​

Source files that had results​

org.openrewrite.table.SourcesFileResults

Source files that were modified by the recipe run.

Column NameDescription
Source path before the runThe source path of the file before the run. null when a source file was created during the run.
Source path after the runA recipe may modify the source path. This is the path after the run. null when a source file was deleted during the run.
Parent of the recipe that made changesIn a hierarchical recipe, the parent of the recipe that made a change. Empty if this is the root of a hierarchy or if the recipe is not hierarchical at all.
Recipe that made changesThe specific recipe that made a change.
Estimated time savingAn estimated effort that a developer to fix manually instead of using this recipe, in unit of seconds.
CycleThe recipe cycle in which the change was made.