Skip to content

Commit 7f586ba

Browse files
sethsecsethsec
authored
Merge pull request #8 from DataDog/update-contributing-guide-and-tools
Update contributing guide and tools
2 parents 84dd65c + 9e7541b commit 7f586ba

11 files changed

Lines changed: 807 additions & 193 deletions

File tree

‎.github/ISSUE_TEMPLATE/bug_report.md‎

Lines changed: 41 additions & 16 deletions
Original file line numberDiff line numberDiff line change
@@ -1,27 +1,52 @@
11
---
2-
name: Bug report
3-
about: Create a bug report in Github
4-
title: ''
5-
labels: ''
2+
name: Bug Report
3+
about: Report an error in the website, documentation, or existing path data
4+
title: '[BUG] '
5+
labels: 'bug'
66
assignees: ''
7-
87
---
98

10-
## Categorization
9+
## Bug Description
10+
11+
**What's wrong?**
12+
<!-- A clear and concise description of the bug -->
13+
14+
15+
## Location
16+
17+
**Where is the issue?**
18+
- [ ] Website functionality
19+
- [ ] Existing path data (incorrect information)
20+
- [ ] Documentation (README, CONTRIBUTING, etc.)
21+
- [ ] Validation scripts
22+
- [ ] Other:
23+
24+
**Specific file or page affected:**
25+
<!-- e.g., data/paths/iam/iam-001.yaml or https://pathfinding.cloud/paths/iam-001 -->
26+
27+
28+
## Details
29+
30+
**Steps to Reproduce** *(for website/script bugs)*
31+
1.
32+
2.
33+
3.
34+
35+
**Expected Behavior**
36+
<!-- What should happen? -->
37+
1138

12-
- [ ] New Path
13-
- [ ] Add / Update / Fix info within an existing path
14-
- [ ] New Feature / Major Change / Refactor / Optimization
15-
- [ ] Non path based documentation Update (Readme, etc)
39+
**Actual Behavior**
40+
<!-- What happens instead? -->
1641

1742

18-
## Description
19-
A clear and concise description of what the bug is.
43+
## Environment *(for website/script bugs)*
2044

21-
## Steps to reproduce
45+
- Browser:
46+
- OS:
47+
- Python version (if running scripts):
2248

23-
## Expected behavior
49+
## Additional Context
2450

25-
## Actual behavior
51+
<!-- Screenshots, error messages, or other helpful information -->
2652

27-
## Environment

‎.github/ISSUE_TEMPLATE/config.yml‎

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,5 @@
1+
blank_issues_enabled: true
2+
contact_links:
3+
- name: Questions & Discussions
4+
url: https://github.com/DataDog/pathfinding.cloud/discussions
5+
about: Ask questions or discuss ideas with the community

‎.github/ISSUE_TEMPLATE/new-path-idea.md‎

Lines changed: 82 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,82 @@
1+
---
2+
name: New Path Idea
3+
about: Suggest a new AWS IAM privilege escalation path
4+
title: '[PATH IDEA] '
5+
labels: 'new-path'
6+
assignees: ''
7+
---
8+
9+
## Path Idea
10+
11+
**Have you discovered or read about an AWS IAM privilege escalation technique?**
12+
13+
Share it here! Don't worry about having all the details - even a rough idea helps. We'll investigate and build out the full documentation.
14+
15+
---
16+
17+
### Required Information
18+
19+
**Name / Permissions Involved** *(required)*
20+
<!-- What IAM permissions are needed? Use format: iam:PassRole + lambda:CreateFunction -->
21+
22+
23+
**Description** *(required)*
24+
<!-- How does this privilege escalation work? What can an attacker gain? -->
25+
26+
27+
**Required Permissions** *(required)*
28+
<!-- List the minimum IAM permissions needed to exploit this path -->
29+
-
30+
-
31+
32+
---
33+
34+
### Optional Information
35+
36+
*Fill in what you know - everything helps!*
37+
38+
**AWS Services Involved**
39+
<!-- e.g., IAM, Lambda, EC2, etc. -->
40+
41+
42+
**Category**
43+
<!-- Which category best fits? -->
44+
- [ ] Self-escalation (modify own permissions)
45+
- [ ] Principal access (gain access to other users/roles)
46+
- [ ] New PassRole (create resource + pass role)
47+
- [ ] Existing PassRole (modify existing resources with attached roles)
48+
- [ ] Credential access (extract credentials from resources)
49+
50+
**Prerequisites**
51+
<!-- What conditions must exist in the environment for this to work? -->
52+
53+
54+
**Exploitation Commands**
55+
<!-- If you have AWS CLI commands or other steps, include them here -->
56+
```bash
57+
58+
```
59+
60+
**Where did you find this?**
61+
<!-- Blog post, research paper, tool source code, personal discovery, etc. -->
62+
<!-- Include links if available -->
63+
64+
65+
**Who should be credited?**
66+
<!-- If you know who originally discovered this technique -->
67+
68+
69+
**Related Paths**
70+
<!-- Are there similar paths already documented on pathfinding.cloud? -->
71+
72+
73+
---
74+
75+
### Additional Context
76+
77+
<!-- Any other information that might be helpful -->
78+
79+
80+
---
81+
82+
*Thank you for contributing to pathfinding.cloud! Even rough ideas help expand the community's knowledge of AWS privilege escalation paths.*

‎.github/workflows/deploy.yml‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -33,9 +33,9 @@ jobs:
3333
run: |
3434
pip install -r scripts/requirements.txt
3535
36-
- name: Validate YAML files
36+
- name: Validate YAML files (no drafts allowed on main)
3737
run: |
38-
python scripts/validate-schema.py data/paths/
38+
python scripts/validate-schema.py data/paths/ --no-draft
3939
4040
- name: Generate JSON files
4141
run: |

‎.github/workflows/validate.yml‎

Lines changed: 26 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -28,10 +28,16 @@ jobs:
2828
run: |
2929
pip install -r scripts/requirements.txt
3030
31-
- name: Validate YAML files
31+
- name: Validate YAML files (PRs - drafts allowed)
32+
if: github.event_name == 'pull_request'
3233
run: |
3334
python scripts/validate-schema.py data/paths/
3435
36+
- name: Validate YAML files (main branch - no drafts)
37+
if: github.event_name == 'push' && github.ref == 'refs/heads/main'
38+
run: |
39+
python scripts/validate-schema.py data/paths/ --no-draft
40+
3541
- name: Comment on PR (on failure)
3642
if: failure() && github.event_name == 'pull_request'
3743
uses: actions/github-script@v7
@@ -44,14 +50,32 @@ jobs:
4450
body: '❌ Schema validation failed. Please check the validation errors above and fix your YAML files according to the [schema documentation](../blob/main/SCHEMA.md).'
4551
})
4652
53+
- name: Check for draft paths
54+
if: success() && github.event_name == 'pull_request'
55+
id: check-drafts
56+
run: |
57+
DRAFT_COUNT=$(grep -rl "status: draft" data/paths/ 2>/dev/null | wc -l | tr -d ' ')
58+
echo "draft_count=$DRAFT_COUNT" >> $GITHUB_OUTPUT
59+
if [ "$DRAFT_COUNT" -gt 0 ]; then
60+
echo "Found $DRAFT_COUNT draft path(s)"
61+
echo "draft_files<<EOF" >> $GITHUB_OUTPUT
62+
grep -rl "status: draft" data/paths/ >> $GITHUB_OUTPUT
63+
echo "EOF" >> $GITHUB_OUTPUT
64+
fi
65+
4766
- name: Comment on PR (on success)
4867
if: success() && github.event_name == 'pull_request'
4968
uses: actions/github-script@v7
5069
with:
5170
script: |
71+
const draftCount = '${{ steps.check-drafts.outputs.draft_count }}';
72+
let body = '✅ All YAML files passed schema validation!';
73+
if (parseInt(draftCount) > 0) {
74+
body += `\n\n📝 **Note:** This PR contains ${draftCount} draft path(s) with \`status: draft\`. A maintainer will enhance these before merging.`;
75+
}
5276
github.rest.issues.createComment({
5377
issue_number: context.issue.number,
5478
owner: context.repo.owner,
5579
repo: context.repo.repo,
56-
body: '✅ All YAML files passed schema validation!'
80+
body: body
5781
})

‎CLAUDE.md‎

Lines changed: 16 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -194,6 +194,7 @@ For complete field specifications, see [SCHEMA.md](SCHEMA.md).
194194

195195
| Field | Type | Quick Description | Details |
196196
|-------|------|-------------------|---------|
197+
| `status` | enum | `draft` for partial submissions, omit for complete | [CONTRIBUTING.md](CONTRIBUTING.md#option-2-submit-a-draft-pr) |
197198
| `prerequisites` | object/array | Conditions required for escalation | [SCHEMA.md](SCHEMA.md#prerequisites-object-or-array) |
198199
| `limitations` | string | When admin vs limited access is achieved | [SCHEMA.md](SCHEMA.md#limitations-string-optional) |
199200
| `references` | array | External links and documentation | [SCHEMA.md](SCHEMA.md#references-array-of-objects) |
@@ -268,6 +269,21 @@ Can you task the detection-tools, learning-environments, add-vis, and attributio
268269
- Exploitation steps are numbered sequentially from 1
269270
- No unexpected fields
270271

272+
### Draft Mode
273+
274+
The validation script supports draft submissions with relaxed requirements:
275+
276+
```bash
277+
# Normal mode - allows drafts (for PRs)
278+
python scripts/validate-schema.py data/paths/
279+
280+
# Strict mode - no drafts allowed (for main branch)
281+
python scripts/validate-schema.py data/paths/ --no-draft
282+
```
283+
284+
**Draft paths** (`status: draft`) only require: id, name, category, services, permissions.required, description
285+
**Complete paths** (no status) require all fields including exploitationSteps, recommendation, discoveryAttribution
286+
271287
## Website Generation
272288

273289
The website loads data from `docs/paths.json`, which is generated from YAML files:

0 commit comments

Comments
 (0)