Release: Merge release into master from: release/2.55.0

[github-actions]

Release triggered by rossops

[dryrunsecurity]

This pull request introduces multiple GitHub Actions security issues: an actions/checkout step that persists GITHUB_TOKEN when mounting the repo into test containers (allowing malicious PR code to exfiltrate the token), an input injection vulnerability in release-1-create-pr.yml where unvalidated release_number is interpolated into shell commands enabling command execution, and a logic-bypass in test-helm-chart.yml that trusts branch naming (github.head_ref) allowing attackers to run privileged steps and exploit a shell injection via the PR title.

CI/CD Hardening: GitHub Token Persistence Risk in .github/workflows/integration-tests.yml

Vulnerability

CI/CD Hardening: GitHub Token Persistence Risk

Description

The 'actions/checkout' step in the integration-tests.yml workflow (hunk 17) is used without the 'persist-credentials: false' option. By default, this action persists the GITHUB_TOKEN in the local .git/config file. This workflow subsequently executes integration tests by mounting the repository's root directory into Docker containers. Since these tests include Python scripts from the repository that can be modified by external contributors via Pull Requests, an attacker could submit a malicious PR that extracts the GITHUB_TOKEN from the mounted .git/config file. This risk is particularly notable as other similar test workflows in the same codebase (e.g., rest-framework-tests.yml, hunk 24) correctly implement 'persist-credentials: false', indicating an inconsistent security posture.

django-DefectDojo/.github/workflows/integration-tests.yml

Lines 41 to 60 in 2895d41

	"tests/notifications_test.py",
	"tests/tool_config.py",
	"openapi-validatator",
	]
	os: [alpine, debian]
	v3_feature_locations: [true, false]
	exclude:
	# standalone create endpoint page is gone in v3
	- v3_feature_locations: true
	test-case: "tests/endpoint_test.py"
	fail-fast: false
	env:
	DD_V3_FEATURE_LOCATIONS: ${{ matrix.v3_feature_locations }}
	steps:
	- name: Checkout
	uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
	# load docker images from build jobs
	- name: Load images from artifacts

Shell Injection: Unvalidated Input in Git Command in .github/workflows/release-1-create-pr.yml

Vulnerability

Shell Injection: Unvalidated Input in Git Command

Description

The workflow .github/workflows/release-1-create-pr.yml is vulnerable to shell command injection via the release_number input. This input is directly interpolated into several shell commands in run steps using the ${{ inputs.release_number }} syntax. Because GitHub Actions expands these expressions before passing the command to the shell, an attacker can provide an input containing shell metacharacters (like ;, $(...), or ') to execute arbitrary commands. The 'Validate' steps also use the vulnerable input in an echo command and can be easily bypassed. This allows an attacker with write access to execute arbitrary code on the runner and potentially exfiltrate secrets or bypass branch protections.

django-DefectDojo/.github/workflows/release-1-create-pr.yml

Lines 40 to 46 in 2895d41

	run: echo "GITHUB_ORG=${GITHUB_REPOSITORY%%/*}" >> $GITHUB_ENV
	- name: Checkout from_branch branch
	uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
	with:
	ref: ${{ inputs.from_branch }}

CI/CD Logic Bypass: Insecure Pull Request Handling in .github/workflows/test-helm-chart.yml

Vulnerability

CI/CD Logic Bypass: Insecure Pull Request Handling

Description

The workflow .github/workflows/test-helm-chart.yml uses the github.head_ref context variable in an if condition to determine whether to execute steps reserved for trusted bots (Renovate and Dependabot). Since github.head_ref is the name of the branch in the source repository (which can be an external fork), an attacker can spoof this value by naming their branch with a prefix like renovate/. This bypass allows an attacker to trigger the documentation update job, which contains a step ('Update values in HELM chart') vulnerable to shell command injection via the pull request title (${{ github.event.pull_request.title }}). Although the default GITHUB_TOKEN for pull requests from forks is read-only (mitigating unauthorized pushes to the base repository), the logic bypass enables arbitrary code execution on the GitHub Actions runner and the ability to skip mandatory linting checks (like the 'artifacthub.io/changes' annotation check).

django-DefectDojo/.github/workflows/test-helm-chart.yml

Lines 133 to 136 in 2895d41

	if: startsWith(github.head_ref, 'renovate/') || startsWith(github.head_ref, 'dependabot/')
	with:
	chart-search-root: "helm/defectdojo"
	git-push: true

---

All finding details can be found in the DryRun Security Dashboard.