Fix insecure workflow. #297
Merged
Conversation
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Actions triggered on "issue_comment" have access to write permissions and repository secrets by default. If we checkout and build untrusted code an attacker can get access to the secrets as well. They can exe- cute code by adding a jekyll ruby plugin in "_plugins/malicious.rb". To prevent this, we split the building of the site and pushing the site to gh-pages and commenting on the PR. The site building is done with only read permissions, so running untrusted code is not a problem. If the site building finished successfully a privileged action is triggered that then pushed the site to the gh-pages branch and comments on the PR
|
@intrigus-lgtm thank you so much for this. We all really appreciate it! I'll let @LKedward review it. |
LKedward
approved these changes
Jul 27, 2021
awvwgk
approved these changes
Jul 27, 2021
milancurcic
approved these changes
Jul 28, 2021
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Actions triggered on "issue_comment" have access to
write permissions and repository secrets by default.
If we checkout and build untrusted code an attacker
can get access to the secrets as well. They can exe-
cute code by adding a jekyll ruby plugin in
"_plugins/malicious.rb".
To prevent this, we split the building of the site
and pushing the site to gh-pages and commenting on
the PR.
The site building is done with only read
permissions, so running untrusted code is not a
problem. If the site building finished successfully
a privileged action is triggered that then pushed
the site to the gh-pages branch and comments on the
PR.
I also added a check that prevents pushing
".github/workflows/" files to the gh-pages branch, because
this would allow secret extraction and repository modification as well.
(If you can add new workflows files you do what every you want inside them)