[Safe Outputs Conformance] SEC-005: unified_session_payload.cjs and unified_session_render.cjs reference targetRepo without allowlist validation #70802

Conformance Check Failure

Check ID: SEC-005
Severity: HIGH
Category: Security

Problem Description

The conformance checker flagged two session-telemetry modules that reference a targetRepo identifier without an adjacent allowlist/validation check:

• actions/setup/js/unified_session_payload.cjs (line 433) — normalizes a targetRepo/target_repo field alias into session payload metadata.
• actions/setup/js/unified_session_render.cjs (line 276) — includes targetRepo in a list of fields rendered into human-readable session log lines.

Per the Safe Outputs Specification's SEC-005 rule (Cross-Repository Validation), any handler that supports a cross-repository target MUST validate the target against an allowlist (allowed-repos, validateTargetRepo, or checkAllowedRepo) before acting on it.

Affected Components

• Files:

  • actions/setup/js/unified_session_payload.cjs (line 433)
  • actions/setup/js/unified_session_render.cjs (line 276)

• Workflows: N/A — shared session telemetry library, not a single workflow

• Handlers: Session payload normalization / session log rendering, not a safe-output write handler

Remediation Steps

This task can be assigned to a Copilot coding agent with the following steps:

1. Trace how targetRepo/target_repo flows out of unified_session_payload.cjs and unified_session_render.cjs — confirm whether either module performs, or feeds, a cross-repository GitHub write, or whether it is purely telemetry/log display.
2. If purely telemetry/display: add a @safe-outputs-exempt SEC-005 annotation comment above the targetRepo reference in each file, with a one-line justification.
3. If it does influence a write path: add an allowlist check (reuse validateTargetRepo/checkAllowedRepo from an existing cross-repo handler such as actions/setup/js/add_labels.cjs) before the value is used.
4. Re-run the conformance script and confirm SEC-005 passes.

Verification

After remediation, verify the fix by running:

bash scripts/check-safe-outputs-conformance.sh

The check SEC-005 should pass without errors.

References

• Safe Outputs Specification: docs/src/content/docs/specs/safe-outputs-specification.md
• Conformance Checker: scripts/check-safe-outputs-conformance.sh (line 173)
• Run: §39551296580
• Date: 2026-10-21

Generated by ✅ Daily Safe Outputs Conformance Checker · claude · agent · 81.4 AIC · ⌖ 0.668 AIC · ⊞ 5.4K · ◷

• expires on Oct 21, 2026, 9:53 PM UTC-08:00