rules:
- id: workflow-run-target-code-checkout
  languages:
    - yaml
  message: >-
    This GitHub Actions workflow file uses `workflow_run` and checks out code
    from the incoming pull request. When using `workflow_run`, the Action
    runs in the context of the target repository, which includes access to all repository
    secrets. Normally, this is safe because the Action only runs code from the target
    repository, not the incoming PR. However, by checking out the incoming PR code, you're now using
    the incoming code for the rest of the action. You may be inadvertently executing arbitrary code
    from the incoming PR with access to repository secrets, which would let an attacker steal repository secrets.
    This normally happens by running build scripts (e.g., `npm build` and `make`) or dependency installation
    scripts (e.g., `python setup.py install`).
    Audit your workflow file to make sure no code from the incoming PR is executed.
    Please see https://securitylab.github.com/research/github-actions-preventing-pwn-requests/ for additional
    mitigations.
  metadata:
    category: security
    owasp: "A01:2017 - Injection"
    cwe: "CWE-913: Improper Control of Dynamically-Managed Code Resources"
    likelihood: MEDIUM
    impact: MEDIUM
    confidence: MEDIUM
    subcategory:
    - vuln
    references:
      - https://securitylab.github.com/research/github-actions-preventing-pwn-requests/
      - https://github.com/justinsteven/advisories/blob/master/2021_github_actions_checkspelling_token_leak_via_advice_symlink.md
      - https://www.legitsecurity.com/blog/github-privilege-escalation-vulnerability
    technology:
      - github-actions
  patterns:
    - pattern-inside: |
        on:
          ...
          workflow_run: ...
          ...
        ...
    - pattern-inside: |
        jobs:
          ...
          $JOBNAME:
            ...
            steps:
              ...
    - pattern: |
        ...
        uses: "$ACTION"
        with:
          ...
          ref: $EXPR
    - metavariable-regex:
        metavariable: $ACTION
        regex: actions/checkout@.*
    - metavariable-pattern:
        language: generic
        metavariable: $EXPR
        patterns:
          - pattern: ${{ github.event.workflow_run ... }}
  severity: WARNING