New audit: typosquat-uses#1985
Conversation
woodruffw
left a comment
There was a problem hiding this comment.
Thanks @andrew! I agree this would be a great audit to have, and thanks a ton for working on it.
Mostly nits from me; the only general question I have is around case handling -- right now the uses: clauses get folded to lowercase; are there any concerns/risks with doing that? The answer is probably 'no' but I'm not 100% sure since I'm not sure how typomania works 🙂
|
Thanks for the review, all addressed in 79e8f0f. On case folding: GitHub treats owner and repo names as case-insensitive ( |
79e8f0f to
1c075c6
Compare
|
I've also got a few improvement prs open on typomania, so hopefully there will be a new release of that before 1.2.6 comes around |
|
(This also reminded me that I need to break |
e129417 to
79b0b31
Compare
|
Thank you @andrew! |
Pre-submission checks
Closes #1989. Developed with Claude Code (Opus 4.7); I've reviewed the diff and can explain every change without referring back to the tool.
Summary
Adds a
typosquat-usesaudit that flagsuses:references one edit away from a popular action but owned by a different account, e.g.action/checkoutordokcer/login-action.Uses the typomania library against a baked-in corpus of ~50 popular actions in
crates/zizmor/data/popular-actions.txt. The owner is treated as the package author so near-misses within the same org (e.g.actions/chckout) are ignored, since that namespace is already controlled and the step just 404s at runtime.Works offline at low confidence. With a GitHub token it checks whether the misspelled repo actually exists and bumps confidence to high when it does. Adds
Client::repo_existsfor the lookup.In a scan of ~150k repos this pattern surfaced ~15 near-misses, almost all harmless same-org typos. Only two resolved to live repos under a different owner. So the value here is less about finding active squats and more about catching the dangerous case where a typo'd owner name points at a namespace someone else could register.
The corpus is hand-seeded for now. Happy to add a
support/popular-actions.pygenerator along the lines ofarchived-reposif the approach looks right.Test Plan
Integration test at
crates/zizmor/tests/integration/audit/typosquat_uses.rswith a fixture covering omission, transposition, homoglyph, repetition, and owner-transposition positive cases plus two negative cases (same-owner near-miss, unrelated slug). Snapshot is inline. The online (high-confidence) branch is not covered by a test since it needs a live foreign-owned squat; tested manually that the offline path produces correct findings.