Loading

Loading...

Back to Documentation

Security PolicyGHA-SEC009

GHA-SEC009Missing Checksum for Downloads

Problem Statement

Downloaded scripts should be validated for integrity.

Vulnerability

Remote Code Execution

Code Examples

Insecure Implementation

- run: curl -sSL http://example.com/script.sh | bash

Secure Implementation

- run: |
    curl -sSL -o script.sh http://example.com/script.sh
    echo "abcd1234  script.sh" | sha256sum -c -
    bash script.sh

Remediation Steps

Validate all downloads before execution using SHA256 or GPG signatures.