### Impact

Like Docker Compose, compose-lint follows symlinks when it reads a project's files. Unlike Compose, compose-lint up to 0.24.0 could then put the contents of a file from *outside* the project into its output, where the author of a pull request can read it.

A pull request can commit a symlink, under a name compose-lint reads, pointing at a file on the CI runner:

- **The Compose file itself (0.2.0–0.24.0).** A `compose.yml` that is a symlink, whether the pre-commit hook passes its name or the Action or a bare run finds it.
- **`compose.override.yml` (0.22.0–0.24.0),** which compose-lint merges automatically.
- **A `COMPOSE_FILE` entry (0.22.0–0.24.0)** in a `.env` beside the Compose file.

When the target is not valid YAML, the parse error quotes the line it failed on. Docker Compose, given the same file, reports only a line number. That line reaches standard error (the job log), JSON `errors[]`, and the SARIF `toolExecutionNotifications`, which the Action uploads to Code Scanning.

A fourth route: from 0.23.0, a symlinked `env_file:` target makes CL-0020 and CL-0021 report the credential-like **key names** in a file outside the project. Values are not printed.

What can be read is one line of a file chosen by path, at the point where the YAML parser fails, which the attacker cannot choose; or key names. A symlink to `/proc/self/environ` gave neither in testing. The pass/fail result is not affected. On a public repository the job log is visible to the pull request's author.

Found during an internal pre-1.0 security review.

**GitHub Action.** Action tags v0.18.0 through v0.24.0 install their own compose-lint version and are affected. Earlier tags install the newest release unless `version:` is set; they were affected while that was 0.24.0 or earlier.

**Docker image.** `composelint/compose-lint` tags 0.3.3 through 0.24.0, and the matching minor tags, are affected. Inside the container a symlink resolves within the container, so what can be read is the container's own files and anything mounted into it. Fixed from `0.25.0`.

### Patches

Fixed in 0.25.0. Parse errors no longer quote the source line; the error and its line and column are kept. `env_file:` targets and `COMPOSE_FILE` entries that resolve outside the project are also refused, with the existing outside-the-project note. Symlinks that stay inside the project still work.

From 0.25.0 through 0.31.0, a committed symlink to a target that is itself a Compose file could still be read, and its values could reach findings. 0.32.0 stops following a discovered, named or override Compose file whose link leaves the checkout.

A related gap for the sibling `.env` file is covered by GHSA-6wcv-rj3c-mhv3, and one for a symlinked `.compose-lint.yml` by GHSA-88f4-frh5-gmcr.

### Workarounds

- Upgrade to 0.25.0 or later.
- On older versions, don't run compose-lint on untrusted pull requests on a machine whose files outside the checkout hold credentials. `--no-env` closes the `COMPOSE_FILE` and `env_file:` routes, but not the others.

### Reproduction

```
project/compose.yml -> /path/outside/project/credentials (symlink)
```

`compose-lint --format sarif compose.yml` on 0.24.0 exits 2, and the SARIF notification quotes a line of the linked file. On 0.25.0 the error gives only the line and column.