[security-fix] Security Fix: Prevent injection in secret redaction YAML generation

[github-actions]

Security Fix: Prevent Injection in Secret Redaction YAML Generation

Alert Number: #10
Severity: Critical
Rule: go/unsafe-quoting
File: pkg/workflow/redact_secrets.go:70

Vulnerability Description

CodeQL identified a critical security vulnerability where JSON values containing single quotes could break out of enclosing quotes when embedded in YAML strings. This potentially unsafe quoting pattern could lead to:

• Command Injection (CWE-78)
• SQL Injection (CWE-89)
• Code Injection (CWE-94)

The vulnerability occurred in the generateSecretRedactionStep function where secret references were embedded directly into YAML strings without proper escaping:

// BEFORE (vulnerable)
yaml.WriteString(fmt.Sprintf("          GITHUB_AW_SECRET_NAMES: '%s'\n", strings.Join(secretReferences, ",")))
yaml.WriteString(fmt.Sprintf("          SECRET_%s: ${{ secrets.%s }}\n", secretName, secretName))

If a secret name contained a single quote (e.g., SECRET'NAME), it would break out of the enclosing quotes and could potentially inject malicious YAML content.

Fix Applied

Added a new escapeSingleQuote() helper function that properly sanitizes data before embedding it in single-quoted YAML strings:

func escapeSingleQuote(s string) string {
    // First escape backslashes, then escape single quotes
    s = strings.ReplaceAll(s, `\`, `\\`)
    s = strings.ReplaceAll(s, `'`, `\'`)
    return s
}

Applied this escaping to all secret references before embedding them in the YAML:

// AFTER (secure)
escapedRefs := make([]string, len(secretReferences))
for i, ref := range secretReferences {
    escapedRefs[i] = escapeSingleQuote(ref)
}
yaml.WriteString(fmt.Sprintf("          GITHUB_AW_SECRET_NAMES: '%s'\n", strings.Join(escapedRefs, ",")))

escapedSecretName := escapeSingleQuote(secretName)
yaml.WriteString(fmt.Sprintf("          SECRET_%s: ${{ secrets.%s }}\n", escapedSecretName, escapedSecretName))

Security Best Practices

1. Escape backslashes first: Prevents backslash escaping from interfering with quote escaping
2. Escape single quotes: Prevents breaking out of single-quoted strings
3. Minimal changes: Only added escaping where needed, maintaining code functionality
4. Defense in depth: Protects against malicious or malformed secret names

Testing Considerations

• Verify that workflows with normal secret names continue to work correctly
• Test with secret names containing special characters (if possible in test environment)
• Ensure the redaction step still properly masks secret values in logs
• Validate that the generated YAML remains syntactically correct

References

• CodeQL Rule: go/unsafe-quoting
• CWE-78: Improper Neutralization of Special Elements used in an OS Command
• CWE-89: SQL Injection
• CWE-94: Improper Control of Generation of Code

---

🤖 Generated with Claude Code

AI generated by Security Fix PR

[github-actions]

Agentic Changeset Generator triggered by this pull request