open/llm-security
1
0
Fork 0
Code Issues Releases 1 Activity

fix(llm-security): YAML/workflow parser divergence — block scalars + bare if: (#32,#33,#43)

Browse source 
#33 the frontmatter parser collected a block-scalar body (description: |) but did not skip it, so an indented name:/allowed_tools: inside the body re-matched as a top-level key and overrode the real values TRG-shadow and permission checks depend on; the parser now consumes block-scalar bodies as opaque content. #32 block-scalar headers carrying indentation/chomping indicators (|2, >-, |-2) were not recognized, so their bodies never reached the run: injection sink; now matched via a proper indicator/chomping regex.

#43 the B4 actor auth-bypass detector inspected only braced ${{ }} expressions, missing the canonical bare 'if: github.actor == ...' form (Synacktiv Dependabot-spoof false negative); bare if: expressions now emit a synthetic event the detector reads. Suite 2004/0.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

Claude-Session: https://claude.ai/code/session_01TcQyMTQfyrsAapaCMPxTtQ
This commit is contained in:
Kjell Tore Guttormsen 2026-07-18 10:35:56 +02:00
commit b224e18b42
8 changed files with 244 additions and 7 deletions
Download patch file Download diff file Expand all files Collapse all files

68
tests/lib/workflow-yaml-state.test.mjs
View file

@ -101,6 +101,74 @@ describe('parseWorkflow — block scalars', () => {
const { events } = parseWorkflow(yml);
assert.ok(events.find(e => e.parent === 'run' && e.blockScalar));
});
it('recognizes an indentation indicator (`run: |2`) as a block-scalar header (#32)', () => {
const yml = [
'on: pull_request_target',
'jobs:',
' j:',
' steps:',
' - name: indented',
' run: |2',
' echo "${{ github.event.issue.title }}"',
].join('\n');
const { events } = parseWorkflow(yml);
const runs = events.filter(e => e.parent === 'run');
assert.equal(runs.length, 1);
assert.equal(runs[0].expr, 'github.event.issue.title');
assert.equal(runs[0].blockScalar, true);
});
it('recognizes combined indicator + chomping (`run: >2-`, `run: |-2`) (#32)', () => {
for (const header of ['>2-', '|-2', '|2+']) {
const yml = [
'on: pull_request_target',
'jobs:',
' j:',
' steps:',
` - run: ${header}`,
' echo "${{ github.head_ref }}"',
].join('\n');
const { events } = parseWorkflow(yml);
const runs = events.filter(e => e.parent === 'run');
assert.equal(runs.length, 1, `header ${header}: expected 1 run event, got ${runs.length}`);
assert.equal(runs[0].blockScalar, true, `header ${header}: expected blockScalar=true`);
}
});
});
describe('parseWorkflow — bare if: values (#43)', () => {
it('emits an if-context event for a bare (non-braced) if: expression', () => {
const yml = [
'on: pull_request_target',
'jobs:',
' j:',
' runs-on: ubuntu-latest',
" if: github.actor == 'dependabot[bot]'",
' steps:',
' - run: echo ok',
].join('\n');
const { events } = parseWorkflow(yml);
const ifs = events.filter(e => e.parent === 'if');
assert.equal(ifs.length, 1);
assert.equal(ifs[0].expr, "github.actor == 'dependabot[bot]'");
assert.equal(ifs[0].bare, true);
assert.equal(ifs[0].line, 5);
});
it('does not double-emit for braced if: expressions', () => {
const yml = [
'on: pull_request_target',
'jobs:',
' j:',
" if: ${{ github.actor == 'dependabot[bot]' }}",
' runs-on: ubuntu-latest',
].join('\n');
const { events } = parseWorkflow(yml);
const ifs = events.filter(e => e.parent === 'if');
assert.equal(ifs.length, 1);
assert.ok(!ifs[0].bare);
});
});
describe('parseWorkflow — sink-mismatch contexts', () => {