mirror/tinyusb
3
0
Fork 0
mirror of https://github.com/hathach/tinyusb.git synced 2026-08-18 11:02:16 +00:00
Code Issues Packages Projects Releases Wiki Activity

ci(claude): scope Bash allowlist instead of wide-open (Codex P1)

Browse Source 
Codex flagged that @claude can be summoned on a fork PR (the review
workflow even directs fork PRs here), so the checked-out PR content is
potentially attacker-controlled. Unrestricted Bash in this write-token +
OAuth-secret job let prompt injection steer Claude into arbitrary
shell/network commands.

Scope Bash to the repo's actual verification commands (cmake, ninja,
make, ctest, python/python3, pre-commit, clang-format, codespell, git).
This blocks the injection-to-arbitrary-command path while still letting
Claude build/test before committing. Building fork code itself is already
done by the existing CircleCI, so that surface is unchanged.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
This commit is contained in:
hathach
2026-06-02 10:42:39 +07:00
parent b009ddb012
commit 6936cc630d
1 changed files with 15 additions and 5 deletions
Download Patch File Download Diff File Expand all files Collapse all files

20
.github/workflows/claude.yml vendored
View File

@ -57,8 +57,18 @@ jobs:
# No custom prompt: Claude performs the instructions in the @claude comment.
# Let summoned runs actually fix bugs: allow Bash so Claude can build/test
# and verify the change before it commits, plus enough turns to investigate.
# File edits (Edit/Write) and git push are handled by the action itself.
# Safe because the job `if` gate restricts this to OWNER/MEMBER/COLLABORATOR.
claude_args: '--allowedTools Bash --max-turns 30'
# Let summoned runs actually fix bugs: allow the repo's build/test/lint
# commands so Claude can verify the change before it commits, plus enough
# turns to investigate. File edits (Edit/Write) and git push are handled
# by the action itself.
#
# Bash is scoped to a curated allowlist rather than wide-open: the job `if`
# gate trusts the *commenter*, but @claude can be summoned on a fork PR
# (claude-code-review.yml even directs fork PRs here), so the checked-out
# PR content is potentially attacker-controlled. Scoping blocks prompt
# injection from steering Claude into arbitrary shell/network commands
# while this job holds the OAuth secret + write token. Keep `bash`/`sh`/
# `curl`/`wget`/`eval` OUT of this list.
claude_args: >-
--allowedTools "Bash(git:*),Bash(cmake:*),Bash(ninja:*),Bash(make:*),Bash(ctest:*),Bash(python3:*),Bash(python:*),Bash(pre-commit:*),Bash(clang-format:*),Bash(codespell:*)"
--max-turns 30