zizmor 1.12.0__tar.gz → 1.12.1__tar.gz

{zizmor-1.12.0 → zizmor-1.12.1}/Cargo.lock

@@ -3832,7 +3832,7 @@ dependencies = [
 
 [[package]]
 name = "zizmor"
-version = "1.12.0"
+version = "1.12.1"
 dependencies = [
  "annotate-snippets",
  "anstream",

{zizmor-1.12.0 → zizmor-1.12.1}/Cargo.toml

@@ -8,6 +8,7 @@ readme = "README.md"
 homepage = "https://docs.zizmor.sh"
 edition = "2024"
 license = "MIT"
+rust-version = "1.88.0"
 
 [workspace.dependencies]
 anyhow = "1.0.98"

{zizmor-1.12.0 → zizmor-1.12.1}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: zizmor
-Version: 1.12.0
+Version: 1.12.1
 License-File: LICENSE
 Home-Page: https://docs.zizmor.sh
 Requires-Python: >=3.9

{zizmor-1.12.0 → zizmor-1.12.1}/crates/github-actions-expressions/src/lib.rs

@@ -425,7 +425,7 @@ impl<'src> Expr<'src> {
             .next()
             .unwrap();
 
-        fn parse_pair(pair: Pair<'_, Rule>) -> Result<Box<SpannedExpr>> {
+        fn parse_pair(pair: Pair<'_, Rule>) -> Result<Box<SpannedExpr<'_>>> {
             // We're parsing a pest grammar, which isn't left-recursive.
             // As a result, we have constructions like
             // `or_expr = { and_expr ~ ("||" ~ and_expr)* }`, which

{zizmor-1.12.0 → zizmor-1.12.1}/crates/github-actions-models/src/workflow/job.rs

@@ -63,12 +63,13 @@ impl<'de> Deserialize<'de> for RunsOn {
         // serde lacks the ability to do inter-field invariants at the derive
         // layer, so we enforce the invariant that a `RunsOn::Group`
         // has either a `group` or at least one label here.
-        if let RunsOn::Group { group, labels } = &runs_on {
-            if group.is_none() && labels.is_empty() {
-                return Err(custom_error::<D>(
-                    "runs-on must provide either `group` or one or more `labels`",
-                ));
-            }
+        if let RunsOn::Group { group, labels } = &runs_on
+            && group.is_none()
+            && labels.is_empty()
+        {
+            return Err(custom_error::<D>(
+                "runs-on must provide either `group` or one or more `labels`",
+            ));
         }
 
         Ok(runs_on)

{zizmor-1.12.0 → zizmor-1.12.1}/crates/yamlpatch/src/lib.rs

@@ -874,35 +874,35 @@ fn apply_value_replacement(
 
             if is_multiline_literal {
                 // Check if this is a multiline string value
-                if let serde_yaml::Value::String(string_content) = value {
-                    if string_content.contains('\n') {
-                        // For multiline literal blocks, use the raw string content
-                        let leading_whitespace = extract_leading_whitespace(doc, feature);
-                        let content_indent = format!("{leading_whitespace}  "); // Key indent + 2 spaces for content
-
-                        // Format as: key: |\n  content\n  more content
-                        let indented_content = string_content
-                            .lines()
-                            .map(|line| {
-                                if line.trim().is_empty() {
-                                    String::new()
-                                } else {
-                                    format!("{}{}", content_indent, line.trim_start())
-                                }
-                            })
-                            .collect::<Vec<_>>()
-                            .join("\n");
-
-                        // Find the position of | in the original content and include it
-                        let pipe_pos = value_part.find('|').unwrap();
-                        let key_with_pipe = &current_content_with_ws
-                            [..colon_pos + 1 + value_part[..pipe_pos].len() + 1];
-                        return Ok(format!(
-                            "{}\n{}",
-                            key_with_pipe.trim_end(),
-                            indented_content
-                        ));
-                    }
+                if let serde_yaml::Value::String(string_content) = value
+                    && string_content.contains('\n')
+                {
+                    // For multiline literal blocks, use the raw string content
+                    let leading_whitespace = extract_leading_whitespace(doc, feature);
+                    let content_indent = format!("{leading_whitespace}  "); // Key indent + 2 spaces for content
+
+                    // Format as: key: |\n  content\n  more content
+                    let indented_content = string_content
+                        .lines()
+                        .map(|line| {
+                            if line.trim().is_empty() {
+                                String::new()
+                            } else {
+                                format!("{}{}", content_indent, line.trim_start())
+                            }
+                        })
+                        .collect::<Vec<_>>()
+                        .join("\n");
+
+                    // Find the position of | in the original content and include it
+                    let pipe_pos = value_part.find('|').unwrap();
+                    let key_with_pipe = &current_content_with_ws
+                        [..colon_pos + 1 + value_part[..pipe_pos].len() + 1];
+                    return Ok(format!(
+                        "{}\n{}",
+                        key_with_pipe.trim_end(),
+                        indented_content
+                    ));
                 }
             }
         }

{zizmor-1.12.0 → zizmor-1.12.1}/crates/yamlpath/src/lib.rs

@@ -347,7 +347,7 @@ impl Document {
     ///
     /// This is typically useful as a "fallback" feature, e.g. for positioning
     /// relative to the "top" of the document.
-    pub fn top_feature(&self) -> Result<Feature, QueryError> {
+    pub fn top_feature(&self) -> Result<Feature<'_>, QueryError> {
         let top_node = self.top_object()?;
         Ok(top_node.into())
     }
@@ -388,7 +388,7 @@ impl Document {
     ///
     /// For example, querying `foo: bar` for `foo` will return
     /// `foo: bar` instead of just `bar`.
-    pub fn query_pretty(&self, route: &Route) -> Result<Feature, QueryError> {
+    pub fn query_pretty(&self, route: &Route) -> Result<Feature<'_>, QueryError> {
         self.query_node(route, QueryMode::Pretty).map(|n| n.into())
     }
 
@@ -401,7 +401,7 @@ impl Document {
     ///
     /// For example, querying `foo: bar` for `foo` will return
     /// just `bar` instead of `foo: bar`.
-    pub fn query_exact(&self, route: &Route) -> Result<Option<Feature>, QueryError> {
+    pub fn query_exact(&self, route: &Route) -> Result<Option<Feature<'_>>, QueryError> {
         let node = self.query_node(route, QueryMode::Exact)?;
 
         if node.kind_id() == self.block_mapping_pair_id || node.kind_id() == self.flow_pair_id {
@@ -423,7 +423,7 @@ impl Document {
     ///
     /// For example, querying `foo: bar` for `foo` will return
     /// just `foo` instead of `foo: bar` or `bar`.
-    pub fn query_key_only(&self, route: &Route) -> Result<Feature, QueryError> {
+    pub fn query_key_only(&self, route: &Route) -> Result<Feature<'_>, QueryError> {
         if !matches!(route.route.last(), Some(Component::Key(_))) {
             return Err(QueryError::Other(
                 "route must end with a key component for key-only routes".into(),
@@ -543,7 +543,7 @@ impl Document {
 
     /// Returns the topmost semantic object in the YAML document,
     /// i.e. the node corresponding to the first block or flow feature.
-    fn top_object(&self) -> Result<Node, QueryError> {
+    fn top_object(&self) -> Result<Node<'_>, QueryError> {
         // All tree-sitter-yaml trees start with a `stream` node.
         let stream = self.tree.root_node();
 
@@ -567,7 +567,7 @@ impl Document {
         Ok(top_node)
     }
 
-    fn query_node(&self, route: &Route, mode: QueryMode) -> Result<Node, QueryError> {
+    fn query_node(&self, route: &Route, mode: QueryMode) -> Result<Node<'_>, QueryError> {
         let mut focus_node = self.top_object()?;
         for component in &route.route {
             match self.descend(&focus_node, component) {

{zizmor-1.12.0 → zizmor-1.12.1}/crates/zizmor/Cargo.toml

@@ -1,12 +1,11 @@
 [package]
 name = "zizmor"
 description = "Static analysis for GitHub Actions"
-version = "1.12.0"
+version = "1.12.1"
 repository = "https://github.com/zizmorcore/zizmor"
 documentation = "https://docs.zizmor.sh"
 keywords = ["cli", "github-actions", "static-analysis", "security"]
 categories = ["command-line-utilities", "security"]
-rust-version = "1.85.0"
 
 homepage.workspace = true
 license.workspace = true

{zizmor-1.12.0 → zizmor-1.12.1}/crates/zizmor/src/audit/cache_poisoning.rs

@@ -75,7 +75,7 @@ static KNOWN_CACHE_AWARE_ACTIONS: LazyLock<Vec<ActionCoordinate>> = LazyLock::ne
         ActionCoordinate::Configurable {
             uses_pattern: "astral-sh/setup-uv".parse().unwrap(),
             control: ControlExpr::single(
-                Toggle::OptOut,
+                Toggle::OptIn,
                 "enable-cache",
                 ControlFieldType::Boolean,
                 true,

{zizmor-1.12.0 → zizmor-1.12.1}/crates/zizmor/src/audit/hardcoded_container_credentials.rs

@@ -73,28 +73,27 @@ impl Audit for HardcodedContainerCredentials {
                         }),
                     ..
                 } = &config
+                    && ExplicitExpr::from_curly(password).is_none()
                 {
-                    if ExplicitExpr::from_curly(password).is_none() {
-                        findings.push(
-                            Self::finding()
-                                .severity(Severity::High)
-                                .confidence(Confidence::High)
-                                .add_location(
-                                    job.location()
-                                        .primary()
-                                        .with_keys([
-                                            "services".into(),
-                                            service.as_str().into(),
-                                            "credentials".into(),
-                                        ])
-                                        .annotated(format!(
-                                            "service {service}: container registry password is \
+                    findings.push(
+                        Self::finding()
+                            .severity(Severity::High)
+                            .confidence(Confidence::High)
+                            .add_location(
+                                job.location()
+                                    .primary()
+                                    .with_keys([
+                                        "services".into(),
+                                        service.as_str().into(),
+                                        "credentials".into(),
+                                    ])
+                                    .annotated(format!(
+                                        "service {service}: container registry password is \
                                          hard-coded"
-                                        )),
-                                )
-                                .build(workflow)?,
-                        )
-                    }
+                                    )),
+                            )
+                            .build(workflow)?,
+                    )
                 }
             }
         }

{zizmor-1.12.0 → zizmor-1.12.1}/crates/zizmor/src/registry.rs

@@ -381,7 +381,9 @@ impl AuditRegistry {
         self.audits.insert(ident, audit);
     }
 
-    pub(crate) fn iter_audits(&self) -> indexmap::map::Iter<&str, Box<dyn Audit + Send + Sync>> {
+    pub(crate) fn iter_audits(
+        &self,
+    ) -> indexmap::map::Iter<'_, &str, Box<dyn Audit + Send + Sync>> {
         self.audits.iter()
     }
 }

{zizmor-1.12.0 → zizmor-1.12.1}/crates/zizmor/tests/integration/snapshot.rs

@@ -537,6 +537,12 @@ fn cache_poisoning() -> Result<()> {
             .run()?
     );
 
+    insta::assert_snapshot!(
+        zizmor()
+            .input(input_under_test("cache-poisoning/issue-1081-repro.yml"))
+            .run()?
+    );
+
     Ok(())
 }
 

zizmor-1.12.1/crates/zizmor/tests/integration/snapshots/integration__snapshot__cache_poisoning-16.snap

@@ -0,0 +1,35 @@
+---
+source: crates/zizmor/tests/integration/snapshot.rs
+expression: "zizmor().input(input_under_test(\"cache-poisoning/issue-1081-repro.yml\")).run()?"
+snapshot_kind: text
+---
+error[cache-poisoning]: runtime artifacts potentially vulnerable to a cache poisoning attack
+  --> @@INPUT@@:5:1
+   |
+ 5 | on: release
+   | ^^^^^^^^^^^ generally used when publishing artifacts generated at runtime
+ 6 |
+...
+14 |       # TRUE POSITIVE: enable-cache enabled by default
+15 |       - uses: astral-sh/setup-uv@d9e0f98d3fc6adb07d1e3d37f3043649ddad06a1 # v6.5.0
+   |         ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ cache enabled by default here
+   |
+   = note: audit confidence → Low
+   = note: this finding has an auto-fix
+
+error[cache-poisoning]: runtime artifacts potentially vulnerable to a cache poisoning attack
+  --> @@INPUT@@:5:1
+   |
+ 5 |   on: release
+   |   ^^^^^^^^^^^ generally used when publishing artifacts generated at runtime
+ 6 |
+...
+18 |         - uses: astral-sh/setup-uv@d9e0f98d3fc6adb07d1e3d37f3043649ddad06a1 # v6.5.0
+19 | /         with:
+20 | |           enable-cache: true
+   | |____________________________^ opt-in for caching here
+   |
+   = note: audit confidence → Low
+   = note: this finding has an auto-fix
+
+2 findings (2 fixable): 0 unknown, 0 informational, 0 low, 0 medium, 2 high

zizmor-1.12.1/crates/zizmor/tests/integration/test-data/cache-poisoning/issue-1081-repro.yml

@@ -0,0 +1,29 @@
+# repro case for https://github.com/zizmorcore/zizmor/issues/1081
+
+name: issue-1081
+
+on: release
+
+permissions: {}
+
+jobs:
+  issue-1081-true-positive:
+    name: issue-1081-true-positive
+    runs-on: ubuntu-latest
+    steps:
+      # TRUE POSITIVE: enable-cache enabled by default
+      - uses: astral-sh/setup-uv@d9e0f98d3fc6adb07d1e3d37f3043649ddad06a1 # v6.5.0
+
+      # TRUE POSITIVE: enable-cache explicitly set to true
+      - uses: astral-sh/setup-uv@d9e0f98d3fc6adb07d1e3d37f3043649ddad06a1 # v6.5.0
+        with:
+          enable-cache: true
+
+  issue-1081-true-negative:
+    name: issue-1081-true-negative
+    runs-on: ubuntu-latest
+    steps:
+      # TRUE NEGATIVE: enable-cache explicitly set to false
+      - uses: astral-sh/setup-uv@d9e0f98d3fc6adb07d1e3d37f3043649ddad06a1 # v6.5.0
+        with:
+          enable-cache: false