Rules / GL072

GL072 `needs:project` artifact download with mutable or variable `ref`

Severity: warn
OWASP: CICD-SEC-3 – Dependency Chain Abuse

What glsec checks

glsec flags needs:project entries — cross-project artifact downloads — whose ref: is mutable or variable-controlled.

needs:project downloads artifacts from another project's job:

build_job:
  needs:
    - project: my-group/my-project
      job: build-1
      ref: main
      artifacts: true

The artifacts come from the latest successful run of that job on the given ref — there is no pinning to a specific pipeline or commit. So:

Mutable ref (ref: main) — anyone who can land a commit on the other project's main controls the binaries, configs, or generated YAML this job consumes.
Variable ref (ref: $ARTIFACTS_DOWNLOAD_REF) — GitLab allows CI/CD variables in project:, job:, and ref:, so a settable variable makes the artifact source attacker-choosable at pipeline time.

This is the needs: analogue of GL003 (unpinned include: ref) and reuses the same mutable-ref classification: a commit SHA is pinned, branch names like main/master/develop/production/latest/HEAD are mutable, and tags are treated as allowed.

Trigger examples

consume_mutable:
  needs:
    - project: my-group/my-project
      job: build
      ref: main                       # mutable branch
      artifacts: true
  script:
    - ./build.sh

consume_variable:
  needs:
    - project: my-group/my-project
      job: build
      ref: $ARTIFACTS_DOWNLOAD_REF     # variable-controlled
      artifacts: true
  script:
    - ./build.sh

Safe alternative

Pin ref: to a commit SHA or release tag:

consume_pinned:
  needs:
    - project: my-group/my-project
      job: build
      ref: 3fa92b1c4d5e6f7081920a1b2c3d4e5f60718293   # commit SHA
      artifacts: true
  script:
    - ./build.sh

What is not flagged

ref: pinned to a commit SHA or a release tag (e.g. v1.2.3).
needs:project with artifacts: false — nothing is downloaded, so there is no poisoning risk.
Plain same-pipeline needs: (needs: [other_job]) and needs:pipeline: — out of scope; no cross-project artifact source.

References

GitLab: needs:project
GL003: include: with a mutable or missing ref

Documentation for glsec 1.23.0. Source of this page · Rule implementation

GL072 needs:project artifact download with mutable or variable ref