Ensure issues deletion is limited to specific users
ID |
issues_deletion |
Severity |
high |
Family |
SCM |
Tags |
least-privilege, non-reachable, repo-permissions, slsa-3, slsa-4 |
Security
Issues are a way to keep track of things happening in repositories, such as setting new milestones or requesting urgent fixes. Deleting an issue is not a benign activity, as it might harm the development workflow or attempt to hide malicious behavior.
Because of this, it should be restricted and allowed only by trusted and responsible users.
Mitigation / Fix
Enforce issues deletion by a few trusted and responsible users only.
GitHub
The ability to delete issues depends on whether the repository is owned by a personal account or an organization:
-
The only account that can delete issues in a repository owned by a personal account is that account.
-
Only accounts with admin or owner permissions can delete issues in a repository owned by an organization.
To delete an issue in a repository owned by an organization, an organization owner must enable deleting issues for the organization’s repositories. For more information, see "Allowing people to delete issues in your organization" and "Repository roles for an organization".
GitLab
GitLab allows users with the Owner role for a project to delete issues.
Issue deletion is documented in "Manage issues > Delete an issue" section of the GitLab documentation.
Azure DevOps (ADO)
Issues (Work Items present in Azure Boards, in ADO parlance) can be deleted, but this is a controlled process designed to prevent accidental data loss. It is documented in "Remove, delete, or restore work items in Azure Boards": A work item can be deleted/restored, or destroyed (permanently deleted).
Before deleting a work item, other alternatives could be followed, such as closing it, changing its state (to Remove or Cut), or linking it to another work item. And remember to export the work item if it is sensitive enough.
Project administrators can always delete work items. Project members have more limited deletion capabilities: They can delete issues that they have created or issues that have been assigned to them.
Project administrators can configure restrictions on who can delete work items: for example, they can limit deletion to project administrators only. This can be done by setting the Project Settings > Permissions > (Group) > Boards/Permanently delete work items option.