[security-fix] Fix unsafe quoting in secret redaction YAML generation (Alert #10)

[github-actions]

Security Fix: Unsafe Quoting in Secret Redaction

Alert Number: #10
Severity: Critical (security_severity_level)
Rule: go/unsafe-quoting
File: pkg/workflow/redact_secrets.go:93

Vulnerability Description

CodeQL identified a potentially unsafe quoting vulnerability in the secret redaction YAML generation code. The issue was on line 93 (previously line 91) where an escaped secret name was being used in a GitHub Actions expression context ${{ secrets.%s }}.

The problem:

• The escapeSingleQuote() function escapes single quotes and backslashes for use in single-quoted YAML strings
• However, GitHub Actions expressions (${{ ... }}) don't use single quotes and have their own syntax rules
• Using escaped values in this context could lead to unexpected behavior or injection vulnerabilities

Fix Applied

Changed line 93 to use the original, unescaped secretName in the GitHub Actions expression:

// Before:
yaml.WriteString(fmt.Sprintf("          SECRET_%s: ${{ secrets.%s }}\n", escapedSecretName, escapedSecretName))

// After:
yaml.WriteString(fmt.Sprintf("          SECRET_%s: ${{ secrets.%s }}\n", escapedSecretName, secretName))

The fix is safe because:

1. Secret names are validated by validateSecretReferences() to match the pattern ^[A-Z][A-Z0-9_]*$
2. This ensures only uppercase letters, numbers, and underscores are allowed
3. These characters are safe to use directly in GitHub Actions expressions
4. The escaped version is still used for the environment variable name prefix where YAML quoting is needed

Security Best Practices

• ✅ Input validation: Secret names are validated before use
• ✅ Context-appropriate escaping: Use unescaped values in expression contexts
• ✅ Defense in depth: Multiple layers of validation and safe handling

Testing Considerations

• Verify that secret names with valid characters (A-Z, 0-9, _) work correctly
• Ensure the generated YAML is syntactically valid
• Confirm that secrets are properly redacted in workflow logs
• Test that the validation function rejects invalid secret names

References

• CWE-78: OS Command Injection
• CWE-89: SQL Injection
• CWE-94: Code Injection

🤖 Generated with Claude Code

AI generated by Security Fix PR

[github-actions]

Agentic Changeset Generator triggered by this pull request