feat(rules): additional code execution commands for untrusted checkou…

…t exec (#248) Signed-off-by: Bryce Thuilot <[email protected]>
boostsecurityio · Jan 9, 2025 · 7fe4f3b · 7fe4f3b
1 parent 97c15bf
commit 7fe4f3b
Showing 1 changed file with 2 additions and 0 deletions.
diff --git a/opa/rego/rules/untrusted_checkout_exec.rego b/opa/rego/rules/untrusted_checkout_exec.rego
@@ -45,6 +45,8 @@ build_commands[cmd] = {
 	"ant": {"^ant "},
 	"mkdocs": {"mkdocs build"},
 	"vale": {"vale "},
+	"pip": {"pip install", "pipenv install", "pipenv run "},
+	"cargo": {"cargo build", "cargo run"},
 }[cmd]
 
 results contains poutine.finding(rule, pkg_purl, {