Skip to content

Commit 312c881

Browse files
committed
update GH_CanEditProtection.md
1 parent ae10655 commit 312c881

1 file changed

Lines changed: 3 additions & 1 deletion

File tree

descriptions/edges/GH_CanEditProtection.md

Lines changed: 3 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,6 @@
11
## General Information
22

3-
The traversable GH_CanEditProtection edge is a computed edge indicating that a role can modify or remove the branch protection rules governing a specific branch. This edge is emitted when the role has GH_EditRepoProtections or GH_AdminTo permissions and the branch is covered by at least one branch protection rule. The edge targets the protected branch (not the BPR itself) because the security impact is evaluated per-branch — a role that can weaken or remove protections on a branch can subsequently push code to it, representing a privilege escalation path.
3+
The traversable GH_CanEditProtection edge is a computed edge indicating that a role can modify or remove branch protection rules in a repository. This edge is emitted when the role has GH_EditRepoProtections or GH_AdminTo permissions and the repository contains at least one protected branch. Repo-targeted edges model the repo-wide security impact for attack path traversal; branch-targeted edges are also emitted as supporting evidence for each protected branch governed by those rules.
44

55
## Scenarios
66

@@ -13,6 +13,7 @@ graph LR
1313
role("GH_RepoRole admin") -->|GH_AdminTo| repo("GH_Repository")
1414
repo -->|GH_HasBranch| branch("GH_Branch main")
1515
bpr("GH_BranchProtectionRule") -->|GH_ProtectedBy| branch
16+
role ==>|GH_CanEditProtection| repo
1617
role ==>|GH_CanEditProtection| branch
1718
```
1819

@@ -25,5 +26,6 @@ graph LR
2526
role("GH_RepoRole custom") -->|GH_EditRepoProtections| repo("GH_Repository")
2627
repo -->|GH_HasBranch| branch("GH_Branch main")
2728
bpr("GH_BranchProtectionRule") -->|GH_ProtectedBy| branch
29+
role ==>|GH_CanEditProtection| repo
2830
role ==>|GH_CanEditProtection| branch
2931
```

0 commit comments

Comments
 (0)