Skip to main content
Menu
On this page
ISSUE-414HighPipeline Composition

Components must come from authorized sources

Control:CTRL-414componentMustComeFromAuthorizedSources

📋 What is this?

An include: component: reference is pulled from a source that is not trusted: not on an explicit allowlist, not under the scanned project's own namespace, not on the same GitLab instance (when that trust is enabled), and not one of GitLab's official namespaces on gitlab.com (when that trust is enabled).

⚠️ Impact

Components run arbitrary code with the job's full context — variables, secrets, and CI_JOB_TOKEN. This is the GitLab analogue of a GitHub Actions "pwn request": an untrusted component source is a direct supply-chain entry point into every pipeline that includes it.

🔧 How to fix

Include components only from a trusted source: add the source to trustedComponents, or rely on trustSameGroupComponents / trustSameInstanceComponents if it already lives in your own namespace or instance, or on trustGitlabOfficialComponents for GitLab's official gitlab.com/components/* and gitlab.com/gitlab-org/* components.

✗ BeforeComponent pulled from an untrusted external namespace
include:
  - component: gitlab.com/attacker/evil-components/backdoor@1.0.0


build:
  script:
    - echo build
✓ AfterComponent trusted: lives under the project's own namespace
include:
  - component: $CI_SERVER_FQDN/$CI_PROJECT_PATH/secret-detection@1.0.0


build:
  script:
    - echo build

💡 Tips

  • trustSameGroupComponents (default true) trusts components under the scanned project's own root namespace.
  • trustSameInstanceComponents (default true) trusts any component on the same GitLab instance. It is ignored on gitlab.com, where Plumber always turns it off because every gitlab.com user shares that instance.
  • trustGitlabOfficialComponents (default true) trusts GitLab's curated gitlab.com/components/* and gitlab.com/gitlab-org/* namespaces. Only the literal gitlab.com host matches, not a same-named namespace on a self-hosted instance.
  • Add third-party components you rely on to trustedComponents as an explicit allowlist (wildcards and $VAR/${VAR} notation supported).
  • Hosts and namespaces compare case-insensitively, as GitLab resolves them: gitlab.com/MyGroup/x is the same namespace as gitlab.com/mygroup/x.
  • A source with a . or .. path segment (also percent-encoded) is never trusted, even when it starts with your own namespace or an allowlisted prefix.
  • Plumber's own CI/CD component (gitlab.com/getplumber/plumber/plumber) is trusted by default: the shipped trustedComponents list carries gitlab.com/getplumber/*.

⚙️ Configure this control

With the CLI alone: set it in your configuration file. Every field and default is in the controls configuration reference, CTRL-414.

🔗 Related issues

ISSUE-415Functions must come from authorized sources
High