Skip to content

Validation Hole #932

New issue
New issue
Open
Bug
Open
Validation Hole#932
Bug
Assignees
cpanato
Labels
bugSomething isn't working
@mattmoor

Description

@mattmoor
mattmoor
opened on Jun 19, 2025

We only check whether we can parse policies today:

app/pkg/webhook/webhook.go

Lines 191 to 202 in cd949cf

switch repo {
case ".github":
if err := yaml.UnmarshalStrict([]byte(raw), &octosts.OrgTrustPolicy{}); err != nil {
log.Infof("failed to parse org trust policy: %v", err)
merr = multierror.Append(merr, fmt.Errorf("%s: %w", f, err))
}
default:
if err := yaml.UnmarshalStrict([]byte(raw), &octosts.TrustPolicy{}); err != nil {
log.Infof("failed to parse trust policy: %v", err)
merr = multierror.Append(merr, fmt.Errorf("%s: %w", f, err))
}

... but we don't check properties that aren't structural, such as that the values of permissions are well formed.

I sent a PR with writ (no e) and this didn't reject it.

Metadata

Metadata

Assignees

Labels

bugSomething isn't working

Type

Bug

Projects

No projects

Milestone

No milestone

Relationships

None yet

Development

No branches or pull requests

Issue actions