TMA-GITHUB-1.1.17

Ensure branch deletions are denied

보통레벨 1자동github

설명

Ensure that users with only push access are incapable of deleting a protected branch. When enabling deletion of a protected branch, any user with at least push access to the repository can delete a branch. This can be potentially dangerous, as a simple human mistake or a hacked account can lead to data ... Checks the default branch: branch deletion is blocked. Satisfied by classic branch protection or an active ruleset (rules/branches). Uses the GitHub REST/GraphQL API through gh api (read-only). The repository comes from GH_REPO or the current git checkout (gh's {owner}/{repo} resolution, GH_HOST for GitHub Enterprise Server); the organization comes from GH_ORG (default: the repository owner). Fails when gh is missing or unauthenticated (gh auth login or GH_TOKEN); organization settings and branch protection need an owner/admin token.

점검 방법

감사 방식: 셸 명령

shell

command -v gh >/dev/null 2>&1 || exit 1
gh auth status >/dev/null 2>&1 || exit 1
info=$(gh api 'repos/{owner}/{repo}' --jq '.full_name + " " + .default_branch' 2>/dev/null) || exit 1
R=${info% *}; B=${info#* }
[ -n "$R" ] && [ -n "$B" ] || exit 1
p=$(gh api "repos/$R/branches/$B/protection" --jq '.allow_deletions.enabled == false' 2>/dev/null) || p=false
s=$(gh api "repos/$R/rules/branches/$B" --jq 'any(.[]; .type == "deletion")' 2>/dev/null) || s=false
[ "$p" = true ] || [ "$s" = true ] && echo compliant

예상 출력: compliant

조치 방법

조치 방식: 가이드 또는 인프라 패치

Settings > Branches (or Rules > Rulesets) for the default branch: leave Allow deletions unchecked (ruleset: Restrict deletions).

속성

운영 체제: 모두
태그: githubsource-code
참고 자료: CIS GitHub Benchmark v1.2.0 - 1.1.17 Ensure branch deletions are denied

이 호스트 점검하기

감사 권한이 있는 시스템에서 실행하세요. 스캔은 읽기 전용입니다.

shell

tmaegis scan --target github