GHSA-88f4-frh5-gmcr

Impact

compose-lint automatically reads a .compose-lint.yml policy file beside the Compose file. It is meant to read nothing outside the project directory, but it follows that file if it is a symlink, wherever it points.

A pull request can commit .compose-lint.yml as a symlink to a file on the CI runner. If the target is not valid YAML, the error compose-lint reports quotes part of the line the parser failed on. That quote reaches the job log (standard error), JSON errors[], and the SARIF toolExecutionNotifications, which the Action uploads to Code Scanning. The run exits 2.

What can be read is small. The quote is cut to about 30 characters around the error position, and the attacker cannot choose which line of the target the parser fails on. For an INI-style credentials file, this was the start of the second line (aws_access_key_id = followed by the first characters of the value). Targets in KEY=value form, and YAML files that parse, disclosed no values in testing. The pass/fail result is not affected. On a public repository, the job log is visible to the pull request's author.

The Compose file loader stopped quoting source lines in parse errors in 0.25.0 (GHSA-whr6-fgpq-fpv9). The policy loader did not.

Found during an internal pre-1.0 security review.

GitHub Action. Action tags v0.18.0 through v0.31.0 install their own compose-lint version and are affected. Earlier tags install the newest release unless version: is set, and so currently install an affected one.

Docker image. composelint/compose-lint tags 0.3.3 through 0.31.0, the matching minor tags, and latest are affected. Inside the container, a symlink resolves within the container, so what can be read is the container's own files and anything mounted into it.

Patches

Fixed in 0.32.0. A .compose-lint.yml discovered in the working directory that resolves outside it is refused with exit 2 rather than read, and a policy parse error no longer quotes the line it failed on, matching the Compose loader. --config is read as given. 0.32.0 also stops following a Compose file that is a symlink to a target outside the checkout.

Workarounds

• Upgrade to 0.32.0 or later.
• Run with an explicit --config pointing at a policy file inside the project; the automatic lookup is then skipped.
• Don't run compose-lint on untrusted pull requests on a machine whose files outside the checkout hold credentials.

Reproduction

project/.compose-lint.yml -> /path/outside/project/credentials   (symlink)
project/compose.yml          services: {web: {image: nginx:1.27}}

compose-lint --format sarif compose.yml exits 2, and the notification text quotes the start of the target's second line.