CycodeLabs / CycodeLabs/raven

Query Environment Information for Workflow Jobs

Open
#119 6 comments 0 reactions 0 assignees View on GitHub
feature
Dominant language
Python
Stars
747
Forks
45
PR merge metrics
No merged PRs in 30d

Description

**Is your feature request related to a problem? Please describe.**

Many workflows that would be vulnerable to pwn requests or injection use a deployment environment with required approvals to protect a job from running. Usually this will manifest as a single job that runs in an environment in the beginning, and all other jobs will depend on that check succeeding.

It is possible to query a list of environments and their rules using the REST API without authentication. By adding this feature it will be possible to update cypher queries to reduce false positives.

**Describe the solution you'd like**

I'd like to see an `Environment` graph object attached to each job. The environment object should track the environment name and if the `protection_rules` array contains one or more entries of the `required_reviewers` class.

Here is an example of a repository that uses deployment environments: https://api.github.com/repos/netflix/mantis/environments

**Describe alternatives you've considered**

None, this is pretty clear cut because environment gating with required approvals will require manual verification to ensure a detection is not a false positive.

**Additional context**

Mentioned this in an earlier issue - https://github.com/CycodeLabs/raven/issues/111, so this covers adding the environment check.

I'm actually working on implementing this and will have a PR open soon!

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.