Check for unquoted YAML strings by fmarier · Pull Request #829 · brave/security-action

fmarier · 2025-07-31T22:58:43Z

https://hitchdev.com/strictyaml/why/implicit-typing-removed/

github-actions · 2025-07-31T23:01:43Z

+server:
+  port: 8080
+  host: "localhost"
+  region: us-west


_{reported by reviewdog 🐶}
[semgrep] Found unquoted string value in YAML file. Consider quoting string values to avoid parsing ambiguity.

Source: https://github.com/brave/security-action/blob/main/assets/semgrep_rules/services/yaml-unquoted-string.yaml

Cc @thypon @kdenhartog

github-actions · 2025-07-31T23:01:43Z

+# This should trigger the rule (unquoted strings)
+
+config:
+  name: production


_{reported by reviewdog 🐶}
[semgrep] Found unquoted string value in YAML file. Consider quoting string values to avoid parsing ambiguity.

Source: https://github.com/brave/security-action/blob/main/assets/semgrep_rules/services/yaml-unquoted-string.yaml

Cc @thypon @kdenhartog

github-actions · 2025-07-31T23:01:43Z

+
+config:
+  name: production
+  type: database


_{reported by reviewdog 🐶}
[semgrep] Found unquoted string value in YAML file. Consider quoting string values to avoid parsing ambiguity.

Source: https://github.com/brave/security-action/blob/main/assets/semgrep_rules/services/yaml-unquoted-string.yaml

Cc @thypon @kdenhartog

github-actions · 2025-07-31T23:01:43Z

+config:
+  name: production
+  type: database
+  environment: staging


_{reported by reviewdog 🐶}
[semgrep] Found unquoted string value in YAML file. Consider quoting string values to avoid parsing ambiguity.

Source: https://github.com/brave/security-action/blob/main/assets/semgrep_rules/services/yaml-unquoted-string.yaml

Cc @thypon @kdenhartog

github-actions · 2025-07-31T23:01:43Z

@@ -0,0 +1,33 @@
+rules:
+  - id: yaml-unquoted-string


_{reported by reviewdog 🐶}
[semgrep] Found unquoted string value in YAML file. Consider quoting string values to avoid parsing ambiguity.

Source: https://github.com/brave/security-action/blob/main/assets/semgrep_rules/services/yaml-unquoted-string.yaml

Cc @thypon @kdenhartog

github-actions

Remaining comments which cannot be posted as a review comment to avoid GitHub Rate Limit

github-actions · 2025-07-31T23:16:07Z

+  environment: staging
+
+server:
+  port: 8080


_{reported by reviewdog 🐶}
[semgrep] Found unquoted string value in YAML file. Consider quoting string values to avoid parsing ambiguity.

Source: https://github.com/brave/security-action/blob/main/assets/semgrep_rules/services/yaml-unquoted-string.yaml

Cc @thypon @kdenhartog

github-actions · 2025-07-31T23:16:07Z

+
+server:
+  port: 8080
+  host: "localhost"


_{reported by reviewdog 🐶}
[semgrep] Found unquoted string value in YAML file. Consider quoting string values to avoid parsing ambiguity.

Source: https://github.com/brave/security-action/blob/main/assets/semgrep_rules/services/yaml-unquoted-string.yaml

Cc @thypon @kdenhartog

github-actions · 2025-07-31T23:16:07Z

+  region: us-west
+
+# Test array items
+languages:


_{reported by reviewdog 🐶}
[semgrep] Found unquoted string value in YAML file. Consider quoting string values to avoid parsing ambiguity.

Source: https://github.com/brave/security-action/blob/main/assets/semgrep_rules/services/yaml-unquoted-string.yaml

Cc @thypon @kdenhartog

github-actions · 2025-07-31T23:16:07Z

+
+# Test array items
+languages:
+  - yaml


_{reported by reviewdog 🐶}
[semgrep] Found unquoted string value in YAML file. Consider quoting string values to avoid parsing ambiguity.

Source: https://github.com/brave/security-action/blob/main/assets/semgrep_rules/services/yaml-unquoted-string.yaml

Cc @thypon @kdenhartog

github-actions · 2025-07-31T23:16:08Z

+# Test array items
+languages:
+  - yaml
+  - json


_{reported by reviewdog 🐶}
[semgrep] Found unquoted string value in YAML file. Consider quoting string values to avoid parsing ambiguity.

Source: https://github.com/brave/security-action/blob/main/assets/semgrep_rules/services/yaml-unquoted-string.yaml

Cc @thypon @kdenhartog

github-actions · 2025-07-31T23:16:09Z

+              - pattern: |
+                  - $VALUE
+              - metavariable-regex:
+                  metavariable: $VALUE


_{reported by reviewdog 🐶}
[semgrep] Found unquoted string value in YAML file. Consider quoting string values to avoid parsing ambiguity.

Source: https://github.com/brave/security-action/blob/main/assets/semgrep_rules/services/yaml-unquoted-string.yaml

Cc @thypon @kdenhartog

github-actions · 2025-07-31T23:16:10Z

+                  - $VALUE
+              - metavariable-regex:
+                  metavariable: $VALUE
+                  regex: '^[a-zA-Z][a-zA-Z0-9_.-]*$'


_{reported by reviewdog 🐶}
[semgrep] Found unquoted string value in YAML file. Consider quoting string values to avoid parsing ambiguity.

Source: https://github.com/brave/security-action/blob/main/assets/semgrep_rules/services/yaml-unquoted-string.yaml

Cc @thypon @kdenhartog

github-actions · 2025-07-31T23:16:10Z

+              - metavariable-regex:
+                  metavariable: $VALUE
+                  regex: '^[a-zA-Z][a-zA-Z0-9_.-]*$'
+              - pattern-not: |


_{reported by reviewdog 🐶}
[semgrep] Found unquoted string value in YAML file. Consider quoting string values to avoid parsing ambiguity.

Source: https://github.com/brave/security-action/blob/main/assets/semgrep_rules/services/yaml-unquoted-string.yaml

Cc @thypon @kdenhartog

github-actions · 2025-07-31T23:16:10Z

+                  regex: '^[a-zA-Z][a-zA-Z0-9_.-]*$'
+              - pattern-not: |
+                  - "$VALUE"
+              - pattern-not: |


_{reported by reviewdog 🐶}
[semgrep] Found unquoted string value in YAML file. Consider quoting string values to avoid parsing ambiguity.

Source: https://github.com/brave/security-action/blob/main/assets/semgrep_rules/services/yaml-unquoted-string.yaml

Cc @thypon @kdenhartog

github-actions · 2025-07-31T23:16:10Z

@@ -0,0 +1,51 @@
+rules:
+  - id: yaml-unquoted-string
+    patterns:


_{reported by reviewdog 🐶}
[semgrep] Found unquoted string value in YAML file. Consider quoting string values to avoid parsing ambiguity.

Source: https://github.com/brave/security-action/blob/main/assets/semgrep_rules/services/yaml-unquoted-string.yaml

Cc @thypon @kdenhartog

Added test cases to verify that strings with spaces, hyphens, and underscores should not be flagged as requiring quotes, while version strings like 1.2.3 and 802.11.x should be flagged. 🤖 Generated with [Claude Code](https://claude.ai/code) Co-Authored-By: Claude <noreply@anthropic.com>

github-actions

Remaining comments which cannot be posted as a review comment to avoid GitHub Rate Limit

assets/semgrep_rules/services/yaml-unquoted-strings.yaml|8| [semgrep] Found unquoted string value in YAML file. Consider quoting string values to avoid parsing ambiguity.

Source: https://github.com/brave/security-action/blob/main/assets/semgrep_rules/services/yaml-unquoted-string.yaml

Cc @thypon @kdenhartog
assets/semgrep_rules/services/yaml-unquoted-strings.yaml|9| [semgrep] Found unquoted string value in YAML file. Consider quoting string values to avoid parsing ambiguity.

Source: https://github.com/brave/security-action/blob/main/assets/semgrep_rules/services/yaml-unquoted-string.yaml

Cc @thypon @kdenhartog

github-actions · 2025-08-01T03:47:42Z

+# Additional test cases for modified rule
+
+# These should NOT trigger the rule (should not require quotes):
+new_config:


_{reported by reviewdog 🐶}
[semgrep] Found unquoted string value in YAML file. Consider quoting string values to avoid parsing ambiguity.

Source: https://github.com/brave/security-action/blob/main/assets/semgrep_rules/services/yaml-unquoted-string.yaml

Cc @thypon @kdenhartog

github-actions · 2025-08-01T03:47:42Z

+
+# These should NOT trigger the rule (should not require quotes):
+new_config:
+  phrase: rule-of-thumb  # has hyphen - should not match


_{reported by reviewdog 🐶}
[semgrep] Found unquoted string value in YAML file. Consider quoting string values to avoid parsing ambiguity.

Source: https://github.com/brave/security-action/blob/main/assets/semgrep_rules/services/yaml-unquoted-string.yaml

Cc @thypon @kdenhartog

github-actions · 2025-08-01T03:47:43Z

+# These should NOT trigger the rule (should not require quotes):
+new_config:
+  phrase: rule-of-thumb  # has hyphen - should not match
+  description: Alice and bob  # has spaces - should not match


_{reported by reviewdog 🐶}
[semgrep] Found unquoted string value in YAML file. Consider quoting string values to avoid parsing ambiguity.

Source: https://github.com/brave/security-action/blob/main/assets/semgrep_rules/services/yaml-unquoted-string.yaml

Cc @thypon @kdenhartog

github-actions · 2025-08-01T03:47:43Z

+new_config:
+  phrase: rule-of-thumb  # has hyphen - should not match
+  description: Alice and bob  # has spaces - should not match
+  float_version: 1.0  # simple numeric - should not match


_{reported by reviewdog 🐶}
[semgrep] Found unquoted string value in YAML file. Consider quoting string values to avoid parsing ambiguity.

Source: https://github.com/brave/security-action/blob/main/assets/semgrep_rules/services/yaml-unquoted-string.yaml

Cc @thypon @kdenhartog

github-actions · 2025-08-01T03:47:43Z

+  phrase: rule-of-thumb  # has hyphen - should not match
+  description: Alice and bob  # has spaces - should not match
+  float_version: 1.0  # simple numeric - should not match
+  setting_name: some_value  # has underscore - should not match


_{reported by reviewdog 🐶}
[semgrep] Found unquoted string value in YAML file. Consider quoting string values to avoid parsing ambiguity.

Source: https://github.com/brave/security-action/blob/main/assets/semgrep_rules/services/yaml-unquoted-string.yaml

Cc @thypon @kdenhartog

github-actions · 2025-08-01T03:47:44Z

+      impact: "LOW"
+      confidence: "MEDIUM"
+      license: "MPL-2.0"
+      source: https://github.com/brave/security-action/blob/main/assets/semgrep_rules/services/yaml-unquoted-string.yaml


_{reported by reviewdog 🐶}
[semgrep] Found unquoted string value in YAML file. Consider quoting string values to avoid parsing ambiguity.

Source: https://github.com/brave/security-action/blob/main/assets/semgrep_rules/services/yaml-unquoted-string.yaml

Cc @thypon @kdenhartog

github-actions · 2025-08-01T03:47:45Z

+      confidence: "MEDIUM"
+      license: "MPL-2.0"
+      source: https://github.com/brave/security-action/blob/main/assets/semgrep_rules/services/yaml-unquoted-string.yaml
+    languages:


_{reported by reviewdog 🐶}
[semgrep] Found unquoted string value in YAML file. Consider quoting string values to avoid parsing ambiguity.

Source: https://github.com/brave/security-action/blob/main/assets/semgrep_rules/services/yaml-unquoted-string.yaml

Cc @thypon @kdenhartog

github-actions · 2025-08-01T03:47:45Z

+  - id: yaml-unquoted-string
+    patterns:
+      - pattern-either:
+          - patterns:


_{reported by reviewdog 🐶}
[semgrep] Found unquoted string value in YAML file. Consider quoting string values to avoid parsing ambiguity.

Source: https://github.com/brave/security-action/blob/main/assets/semgrep_rules/services/yaml-unquoted-string.yaml

Cc @thypon @kdenhartog

github-actions · 2025-08-01T03:47:45Z

+      source: https://github.com/brave/security-action/blob/main/assets/semgrep_rules/services/yaml-unquoted-string.yaml
+    languages:
+      - "yaml"
+    severity: "INFO"


_{reported by reviewdog 🐶}
[semgrep] Found unquoted string value in YAML file. Consider quoting string values to avoid parsing ambiguity.

Source: https://github.com/brave/security-action/blob/main/assets/semgrep_rules/services/yaml-unquoted-string.yaml

Cc @thypon @kdenhartog

github-actions · 2025-08-01T03:47:45Z

+    patterns:
+      - pattern-either:
+          - patterns:
+              - pattern: |


_{reported by reviewdog 🐶}
[semgrep] Found unquoted string value in YAML file. Consider quoting string values to avoid parsing ambiguity.

Source: https://github.com/brave/security-action/blob/main/assets/semgrep_rules/services/yaml-unquoted-string.yaml

Cc @thypon @kdenhartog

Check for unquoted YAML strings

d9f0742

https://hitchdev.com/strictyaml/why/implicit-typing-removed/

fmarier self-assigned this Jul 31, 2025

fmarier requested a review from a team as a code owner July 31, 2025 22:58

github-actions bot reviewed Jul 31, 2025

View reviewed changes

github-actions bot added the needs-security-review label Jul 31, 2025

github-actions bot assigned kdenhartog and thypon Jul 31, 2025

Add support for arrays too

fd07921

github-actions bot reviewed Jul 31, 2025

View reviewed changes

github-actions bot reviewed Aug 1, 2025

View reviewed changes

thypon force-pushed the main branch 4 times, most recently from c9cb82f to df38488 Compare September 24, 2025 15:50

Conversation

fmarier commented Jul 31, 2025

Uh oh!

github-actions bot Jul 31, 2025

Choose a reason for hiding this comment

Uh oh!

github-actions bot Jul 31, 2025

Choose a reason for hiding this comment

Uh oh!

github-actions bot Jul 31, 2025

Choose a reason for hiding this comment

Uh oh!

github-actions bot Jul 31, 2025

Choose a reason for hiding this comment

Uh oh!

github-actions bot Jul 31, 2025

Choose a reason for hiding this comment

Uh oh!

github-actions bot left a comment

Choose a reason for hiding this comment

Uh oh!

github-actions bot Jul 31, 2025

Choose a reason for hiding this comment

Uh oh!

github-actions bot Jul 31, 2025

Choose a reason for hiding this comment

Uh oh!

github-actions bot Jul 31, 2025

Choose a reason for hiding this comment

Uh oh!

github-actions bot Jul 31, 2025

Choose a reason for hiding this comment

Uh oh!

github-actions bot Jul 31, 2025

Choose a reason for hiding this comment

Uh oh!

github-actions bot Jul 31, 2025

Choose a reason for hiding this comment

Uh oh!

github-actions bot Jul 31, 2025

Choose a reason for hiding this comment

Uh oh!

github-actions bot Jul 31, 2025

Choose a reason for hiding this comment

Uh oh!

github-actions bot Jul 31, 2025

Choose a reason for hiding this comment

Uh oh!

github-actions bot Jul 31, 2025

Choose a reason for hiding this comment

Uh oh!

github-actions bot left a comment

Choose a reason for hiding this comment

Uh oh!

github-actions bot Aug 1, 2025

Choose a reason for hiding this comment

Uh oh!

github-actions bot Aug 1, 2025

Choose a reason for hiding this comment

Uh oh!

github-actions bot Aug 1, 2025

Choose a reason for hiding this comment

Uh oh!

github-actions bot Aug 1, 2025

Choose a reason for hiding this comment

Uh oh!

github-actions bot Aug 1, 2025

Choose a reason for hiding this comment

Uh oh!

github-actions bot Aug 1, 2025

Choose a reason for hiding this comment

Uh oh!

github-actions bot Aug 1, 2025

Choose a reason for hiding this comment

Uh oh!

github-actions bot Aug 1, 2025

Choose a reason for hiding this comment

Uh oh!

github-actions bot Aug 1, 2025

Choose a reason for hiding this comment