fix(adversarial): CRITICAL JSON-value injection + 7 audit findings #28
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: CI | |
| on: | |
| push: | |
| branches: [main] | |
| pull_request: | |
| concurrency: | |
| group: ci-${{ github.ref }} | |
| cancel-in-progress: true | |
| env: | |
| LUA_PATH: "./?.lua;./?/init.lua;;" | |
| jobs: | |
| lint: | |
| name: lint (luacheck) | |
| runs-on: ubuntu-latest | |
| steps: | |
| - uses: actions/checkout@v4 | |
| - uses: leafo/gh-actions-lua@v13 | |
| with: | |
| luaVersion: "5.4" | |
| - uses: leafo/gh-actions-luarocks@v4 | |
| - run: luarocks install luacheck | |
| - run: luacheck lua_SQLBuilder spec | |
| unit: | |
| name: unit (Lua ${{ matrix.lua }}) | |
| runs-on: ubuntu-latest | |
| strategy: | |
| fail-fast: false | |
| matrix: | |
| lua: ["5.1", "5.2", "5.3", "5.4", "luajit-2.1"] | |
| steps: | |
| - uses: actions/checkout@v4 | |
| - uses: leafo/gh-actions-lua@v13 | |
| with: | |
| luaVersion: ${{ matrix.lua }} | |
| - uses: leafo/gh-actions-luarocks@v4 | |
| - name: Run unit specs (pure SQL generation, no DB) | |
| run: | | |
| if [ "${{ matrix.lua }}" = "luajit-2.1" ]; then | |
| # LuaJIT cannot load luarocks' large manifests (>65536 constants); | |
| # the zero-dependency runner needs no rocks at all. | |
| lua spec/run.lua spec/unit spec/audit spec/production | |
| else | |
| luarocks install busted | |
| busted --helper=spec/helpers/init.lua spec/unit spec/audit spec/production | |
| fi | |
| integration-sqlite: | |
| name: sqlite integration (Lua ${{ matrix.lua }}) | |
| runs-on: ubuntu-latest | |
| strategy: | |
| fail-fast: false | |
| matrix: | |
| lua: ["5.1", "5.2", "5.3", "5.4"] | |
| steps: | |
| - uses: actions/checkout@v4 | |
| - uses: leafo/gh-actions-lua@v13 | |
| with: | |
| luaVersion: ${{ matrix.lua }} | |
| - uses: leafo/gh-actions-luarocks@v4 | |
| - run: luarocks install busted | |
| - name: Install sqlite driver | |
| run: | | |
| sudo apt-get update | |
| sudo apt-get install -y libsqlite3-dev | |
| luarocks install lsqlite3 | |
| - name: Run integration specs against in-process SQLite | |
| run: busted --helper=spec/helpers/init.lua spec/integration | |
| env: | |
| LUA_SQLBUILDER_DB: sqlite | |
| integration-servers: | |
| name: ${{ matrix.db }} integration (Lua ${{ matrix.lua }}) | |
| runs-on: ubuntu-latest | |
| strategy: | |
| fail-fast: false | |
| matrix: | |
| lua: ["5.1", "5.2", "5.3", "5.4"] | |
| db: [mysql, postgres] | |
| services: | |
| mysql: | |
| image: mysql:8.0 | |
| env: | |
| MYSQL_ROOT_PASSWORD: root | |
| MYSQL_DATABASE: sqlbuilder_test | |
| ports: ["3306:3306"] | |
| options: >- | |
| --health-cmd="mysqladmin ping -h 127.0.0.1 -uroot -proot" | |
| --health-interval=5s | |
| --health-timeout=5s | |
| --health-retries=20 | |
| postgres: | |
| image: postgres:16 | |
| env: | |
| POSTGRES_USER: postgres | |
| POSTGRES_PASSWORD: postgres | |
| POSTGRES_DB: sqlbuilder_test | |
| # trust auth: no crypto needed. pgmoon's md5 AND scram both require | |
| # luaossl/LuaCrypto (openssl); luaossl does not build on OpenSSL 3. | |
| # Server-side scram-stored passwords force SCRAM even with md5 in | |
| # pg_hba, so trust is the only zero-crypto option for CI. | |
| POSTGRES_HOST_AUTH_METHOD: trust | |
| ports: ["5432:5432"] | |
| options: >- | |
| --health-cmd="pg_isready -U postgres -h 127.0.0.1" | |
| --health-interval=5s | |
| --health-timeout=5s | |
| --health-retries=20 | |
| steps: | |
| - uses: actions/checkout@v4 | |
| - uses: leafo/gh-actions-lua@v13 | |
| with: | |
| luaVersion: ${{ matrix.lua }} | |
| - uses: leafo/gh-actions-luarocks@v4 | |
| - run: luarocks install busted | |
| - name: Install DB drivers | |
| run: | | |
| sudo apt-get update | |
| if [ "${{ matrix.db }}" = "mysql" ]; then | |
| sudo apt-get install -y libmysqlclient-dev | |
| luarocks install luasql-mysql MYSQL_INCDIR=/usr/include/mysql MYSQL_LIBDIR=/usr/lib/x86_64-linux-gnu | |
| else | |
| # pgmoon is pure Lua; trust auth needs no crypto rock | |
| # (luaossl does not build against OpenSSL 3) | |
| sudo apt-get install -y libssl-dev | |
| luarocks install luasocket | |
| luarocks install lua-cjson | |
| luarocks install pgmoon | |
| fi | |
| - name: Run integration specs against ${{ matrix.db }} | |
| run: busted --helper=spec/helpers/init.lua spec/integration | |
| env: | |
| LUA_SQLBUILDER_DB: ${{ matrix.db }} | |
| MYSQL_HOST: 127.0.0.1 | |
| MYSQL_PORT: "3306" | |
| MYSQL_USER: root | |
| MYSQL_PASSWORD: root | |
| MYSQL_DATABASE: sqlbuilder_test | |
| POSTGRES_HOST: 127.0.0.1 | |
| POSTGRES_PORT: "5432" | |
| POSTGRES_USER: postgres | |
| POSTGRES_PASSWORD: postgres | |
| POSTGRES_DATABASE: sqlbuilder_test |