Rules / GL024

GL024 Shell pipe without set -o pipefail

Severity: warn
OWASP: CICD-SEC-7 – Insecure System Configuration

What glsec checks

glsec flags jobs that use shell pipes (|) in their scripts without enabling pipefail. By default, a pipeline's exit code is the exit code of the last command in the chain. If any earlier command fails, the failure is silently discarded and the job continues.

This is especially dangerous in security-sensitive contexts:

• A failed curl | bash download still "succeeds" — bash executes with empty input and exits 0
• A failed secret-fetching step before a deployment is ignored
• Corrupted data passes through to downstream steps undetected

Analogous to ansible-lint's risky-shell-pipe rule.

Trigger example

build:
  script:
    - curl https://install.example.com/tool.sh | bash   # if curl fails, bash runs on empty input
    - generate-config | tee config.yml                  # if generate-config fails, job still passes

Safe alternatives

Set once at the top of the script:

build:
  script:
    - set -o pipefail
    - generate-config | tee config.yml
    - curl https://install.example.com/tool.sh | bash

Set as part of a combined shell options header:

build:
  script:
    - set -euo pipefail
    - generate-config | tee config.yml

Set inline per line:

build:
  script:
    - set -o pipefail && generate-config | tee config.yml

Set in before_script to apply to all jobs using the same template:

.base:
  before_script:
    - set -o pipefail

build:
  extends: .base
  script:
    - generate-config | tee config.yml

Notes

• One finding is emitted per job, pointing to the first piped line.
• || (logical OR) and |& (stderr+stdout redirect) are not treated as pipes and do not trigger this rule.
• pipefail set anywhere in before_script, script, after_script, or a run: step suppresses the finding. So does a before_script or script the job inherits through extends: from a job in the same file, from default:, or from a top-level before_script:, unless the job defines that section itself or opts out with inherit: default:.
• Jobs whose runner tags select a Windows runner (a tag containing the word windows, such as windows, saas-windows-medium-amd64 or windows-v2:2022, also through extends: or default: tags) are skipped: their scripts run in PowerShell, which has no pipefail.
• If you intentionally ignore a pipe failure (e.g. cmd | true), suppress the finding inline: # glsec:ignore GL024 -- intentional, fallback handled.

Documentation for glsec 1.23.0. Source of this page · Rule implementation