diff options
| -rw-r--r-- | __test__/input-helper.test.ts | 46 | ||||
| -rw-r--r-- | dist/index.js | 19 | ||||
| -rw-r--r-- | src/input-helper.ts | 24 |
3 files changed, 75 insertions, 14 deletions
diff --git a/__test__/input-helper.test.ts b/__test__/input-helper.test.ts index 4e32e99..66b0df5 100644 --- a/__test__/input-helper.test.ts +++ b/__test__/input-helper.test.ts @@ -140,4 +140,50 @@ describe('input-helper tests', () => { const settings: IGitSourceSettings = await inputHelper.getInputs() expect(settings.workflowOrganizationId).toBe(123456) }) + + describe('unsafe PR checkout guard', () => { + const forkPayload = { + repository: {id: 100}, + pull_request: { + head: { + sha: '1234567890123456789012345678901234567890', + repo: {id: 200, full_name: 'attacker/fork'} + }, + merge_commit_sha: 'aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa' + } + } + + it('allows the default self-checkout on a fork pull_request_target', async () => { + const originalEvent = github.context.eventName + const originalPayload = github.context.payload + try { + github.context.eventName = 'pull_request_target' + github.context.payload = forkPayload as any + // Simulate a rebase/fast-forward merge where the base tip (event SHA) + // equals the PR head SHA. The default self-checkout must still succeed. + github.context.sha = '1234567890123456789012345678901234567890' + const settings: IGitSourceSettings = await inputHelper.getInputs() + expect(settings.commit).toBe('1234567890123456789012345678901234567890') + } finally { + github.context.eventName = originalEvent + github.context.payload = originalPayload + } + }) + + it('refuses an explicit fork repository on pull_request_target', async () => { + const originalEvent = github.context.eventName + const originalPayload = github.context.payload + try { + github.context.eventName = 'pull_request_target' + github.context.payload = forkPayload as any + inputs.repository = 'attacker/fork' + await expect(inputHelper.getInputs()).rejects.toThrow( + /Refusing to check out fork pull request code/ + ) + } finally { + github.context.eventName = originalEvent + github.context.payload = originalPayload + } + }) + }) }) diff --git a/dist/index.js b/dist/index.js index dbd2dbb..16328ff 100644 --- a/dist/index.js +++ b/dist/index.js @@ -18568,12 +18568,19 @@ function getInputs() { (core.getInput('allow-unsafe-pr-checkout') || 'false').toUpperCase() === 'TRUE'; core.debug(`allow unsafe PR checkout = ${result.allowUnsafePrCheckout}`); - unsafePrCheckoutHelper.assertSafePrCheckout({ - qualifiedRepository, - ref: result.ref, - commit: result.commit, - allowUnsafePrCheckout: result.allowUnsafePrCheckout - }); + // The default self-checkout (this repository with no explicit ref) always + // resolves to the trusted ref/commit GitHub set for the triggering event, so + // the fork-checkout guard only needs to run when the caller customized the + // repository or ref. + const isDefaultCheckout = isWorkflowRepository && !core.getInput('ref'); + if (!isDefaultCheckout) { + unsafePrCheckoutHelper.assertSafePrCheckout({ + qualifiedRepository, + ref: result.ref, + commit: result.commit, + allowUnsafePrCheckout: result.allowUnsafePrCheckout + }); + } return result; }); } diff --git a/src/input-helper.ts b/src/input-helper.ts index 1a090c7..7bacac6 100644 --- a/src/input-helper.ts +++ b/src/input-helper.ts @@ -7,7 +7,7 @@ import * as workflowContextHelper from './workflow-context-helper' import {IGitSourceSettings} from './git-source-settings' export async function getInputs(): Promise<IGitSourceSettings> { - const result = ({} as unknown) as IGitSourceSettings + const result = {} as unknown as IGitSourceSettings // GitHub workspace let githubWorkspacePath = process.env['GITHUB_WORKSPACE'] @@ -121,7 +121,8 @@ export async function getInputs(): Promise<IGitSourceSettings> { (core.getInput('persist-credentials') || 'false').toUpperCase() === 'TRUE' // Workflow organization ID - result.workflowOrganizationId = await workflowContextHelper.getOrganizationId() + result.workflowOrganizationId = + await workflowContextHelper.getOrganizationId() // Set safe.directory in git global config. result.setSafeDirectory = @@ -133,12 +134,19 @@ export async function getInputs(): Promise<IGitSourceSettings> { 'TRUE' core.debug(`allow unsafe PR checkout = ${result.allowUnsafePrCheckout}`) - unsafePrCheckoutHelper.assertSafePrCheckout({ - qualifiedRepository, - ref: result.ref, - commit: result.commit, - allowUnsafePrCheckout: result.allowUnsafePrCheckout - }) + // The default self-checkout (this repository with no explicit ref) always + // resolves to the trusted ref/commit GitHub set for the triggering event, so + // the fork-checkout guard only needs to run when the caller customized the + // repository or ref. + const isDefaultCheckout = isWorkflowRepository && !core.getInput('ref') + if (!isDefaultCheckout) { + unsafePrCheckoutHelper.assertSafePrCheckout({ + qualifiedRepository, + ref: result.ref, + commit: result.commit, + allowUnsafePrCheckout: result.allowUnsafePrCheckout + }) + } return result } |