compose-lint: Text in a pull request can issue CI workflow commands through JSON and SARIF output on stdout

Impact

0.31.0 fixed GHSA-6f4g-xm8v-pgv6, where text from a Compose file became GitHub Actions workflow commands in compose-lint's output. --format json and --format sarif output never passed through that fix, so ##[ inside a service name or other value reaches the log intact when the output is printed to stdout rather than written to a file. The runner acts on ##[ in the middle of a line, so the JSON layout does not prevent it.

A pull request can therefore create annotations, fold or hide parts of the job log, or issue other commands the runner accepts, when CI runs compose-lint over it, before anyone reviews it. The pass/fail result is not changed.

Affected setups print JSON or SARIF output to a CI log from the compose-lint package, the pre-commit hook or the Docker image. Writing that output to a file, which SARIF upload requires, is not affected. The GitHub Action turns command processing off around each compose-lint run, so it is not affected.

Found during an internal pre-1.0 security review. It was first published as part of GHSA-r7j4-crjv-h467, together with four other gaps in the same fix. Each gap now has its own advisory.

Docker image. composelint/compose-lint tag 0.31.0 and the matching minor tag are affected, as was latest while it pointed to 0.31.0.

Releases before 0.31.0 are covered by GHSA-6f4g-xm8v-pgv6.

Patches

Fixed in 0.32.0. JSON and SARIF on stdout escape ##[ inside strings as \u005b, which decodes to the same data.

Workarounds

• Upgrade to 0.32.0 or later.
• Write --format json and --format sarif output to a file rather than the log.
• On GitHub Actions, use the tmatens/compose-lint Action, or bracket the compose-lint step with ::stop-commands::<random token> and ::<token>::, as the Action does.

Reproduction

On compose-lint 0.31.0 on a GitHub-hosted runner (runner 2.337.0), a service named a##[warning]X, linted with --format json or --format sarif to stdout, creates annotations. The same file linted with the text report creates none. The composelint/compose-lint:0.31.0 image produces byte-identical output to the package.