rules-bitbucket-actions

RISK: $BITBUCKET_BRANCH used unquoted in a script: block — a malicious branch name causes shell command injection (CWE-78). FIX: Always quote Bitbucket variables: "${BITBUCKET_BRANCH}" or use printf %%q for robust escaping.

RISK: Piping a remote download directly into a shell executes untrusted code without inspection — a compromised upstream URL becomes RCE in the pipeline (supply-chain attack, CWE-494). FIX: Download the script explicitly, verify its SHA-256 checksum against a pinned value, then execute.

RISK: Disabling TLS verification exposes pipeline traffic to MITM attacks. FIX: Remove --insecure / -k / --no-check-certificate; supply a custom CA bundle with --cacert if needed.

RISK: Plaintext secret hardcoded in the 'variables:' block — anyone with read access to the repo can see it, and it persists in git history. FIX: Use Bitbucket Repository Variables (repo settings > Repository variables) and reference them as $VARIABLE_NAME; never embed secret values inline.

RISK: Pinning to ':latest' causes non-reproducible builds and silently pulls unreviewed upstream changes that may include vulnerabilities or supply-chain backdoors. FIX: Pin to an immutable digest or exact version tag (e.g. node:20.14.0-alpine3.20).

RISK: eval on a variable in a pipeline script is a command-injection sink — if any upstream value (branch name, commit message, env var) reaches it, arbitrary commands run with pipeline credentials. FIX: Replace with case/esac dispatch or array-based command construction.

RISK: 'set -x' or 'printenv' in a pipeline step will echo all environment variables — including Bitbucket repository variables (secrets) — to the build log. FIX: Remove 'set -x' from steps that reference secrets; restrict debug tracing to non-secret steps.

RISK: Bitbucket pipe without a pinned semantic version (x.y.z) always fetches the latest tag, which may pull breaking or malicious changes on re-run. FIX: Pin pipes to an exact version, e.g. 'atlassian/aws-s3-deploy:1.6.0', and review changelogs before bumping.