Workflows are referencing vulnerable actions

[igibek]

Hello, there!

As part of the university research we are currently doing regarding the security of Github Actions, we noticed that one or many of the workflows that are part of this repository are referencing vulnerable versions of the third-party actions. As part of a disclosure process, we decided to open issues to notify GitHub Community.

Please note that there are could be some false positives in our methodology, thus not all of the open issues could be valid. If that is the case, please let us know, so that we can improve on our approach. You can contact me directly using an email: ikoishy [at] ncsu.edu

Thanks in advance

1. The workflow compile-mermaid.yml is referencing action gittools/actions/gitversion/setup using references v0.9.6. However this reference is missing the commit 90150b4 which may contain fix to the vulnerability.
2. The workflow compile-mermaid.yml is referencing action gittools/actions/gitversion/execute using references v0.9.6. However this reference is missing the commit 90150b4 which may contain fix to the vulnerability.
3. The workflow release-publish.yml is referencing action gittools/actions/gitversion/setup using references v0.9.6. However this reference is missing the commit 90150b4 which may contain fix to the vulnerability.
4. The workflow release-publish.yml is referencing action gittools/actions/gitversion/execute using references v0.9.6. However this reference is missing the commit 90150b4 which may contain fix to the vulnerability.

The vulnerability fix that is missing by actions' versions could be related to: (1) CVE fix (2) upgrade of vulnerable dependency (3) fix to secret leak and others. Please consider updating the reference to the action.

If you end up updating the reference, please let us know. We need the stats for the paper :-)

[MindaugasLaganeckas]

Unfortunately, we cannot update gittools/actions/gitversion/* because there is no newer version 😢 We will do that asap as the new version gets released.

[aloisklink]

Hi @igibek,

It looks like this is a false positive (or maybe you had outdated data).

https://github.com/mermaid-js/mermaid-cli/commit/304fef11533a95d3616aad2a6635447ab4b0b125 was committed on 13 Aug 2021 and updated all of the gittools/actions to v0.9.10, which doesn't have this vulnerability.

It was an auto-update by @dependabot https://github.com/mermaid-js/mermaid-cli/pull/151.

Thanks for helping hunt down security issues in open-source :smile:, and I hope this reply isn't too late to make it into your paper.

As a side-note, for future disclosures, it might also help to add a line like As of <COMMIT_ID> (COMMITER_DATE) :-)