GHSA-6f4g-xm8v-pgv6

Impact

The GitHub Actions runner treats certain text in a step's output as commands. The legacy form, ##[command], is recognized anywhere in a line. compose-lint's text report prints service names, environment keys and lines of the Compose file, and it does not neutralize ##[. Inside the compose-lint Action, a Compose file from a pull request can therefore:

• create fake error or warning annotations on the pull request (##[error], ##[warning])
• fold the rest of the log, including the real verdict, out of sight (##[group])
• blank out chosen strings for the rest of the log (##[add-mask])

GitHub has postponed removing the deprecated set-output log command, so the runner still honors it. A test run of the Action on a GitHub-hosted runner confirmed that a ::set-output line from a Compose file is processed. Whether it can override the Action's own sarif-written output, which decides whether the SARIF upload step runs, has not been tested.

The exit code and the pass/fail result are not affected. Azure Pipelines parses the same ##[ syntax, so the pip package is listed for anyone printing the text report in other CI systems.

Found during an internal pre-1.0 security review.

Patches

Fixed in 0.31.0. The Action stops the runner from processing workflow commands while compose-lint's output is printed, using a random stop-commands token. The text report also escapes ##[, and :: at the start of a line, in anything taken from the Compose file.

Workarounds

• In your own workflow, wrap the compose-lint step in ::stop-commands::<random token> and ::<random token>::.
• Use --format json or --format sarif rather than the text report when linting untrusted pull requests.

Reproduction

services:
  web:
    image: "nginx:1.25"
    environment:
      "##[error]DB_PASSWORD": placeholder
  "##[group]svc":
    image: "nginx:1.25"
    privileged: true

Run through the Action, this produces a fake error annotation and folds the remaining log lines, including the FAIL verdict, into a collapsed group.