diff options
| -rw-r--r-- | __test__/input-helper.test.ts | 46 | ||||
| -rw-r--r-- | dist/index.js | 19 | ||||
| -rw-r--r-- | src/input-helper.ts | 19 |
3 files changed, 72 insertions, 12 deletions
diff --git a/__test__/input-helper.test.ts b/__test__/input-helper.test.ts index b2f9074..27b023c 100644 --- a/__test__/input-helper.test.ts +++ b/__test__/input-helper.test.ts @@ -180,4 +180,50 @@ describe('input-helper tests', () => { const settings: IGitSourceSettings = await inputHelper.getInputs() expect(settings.workflowOrganizationId).toBe(123456) }) + + describe('unsafe PR checkout guard', () => { + const forkPayload = { + repository: {id: 100}, + pull_request: { + head: { + sha: '1234567890123456789012345678901234567890', + repo: {id: 200, full_name: 'attacker/fork'} + }, + merge_commit_sha: 'aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa' + } + } + + it('allows the default self-checkout on a fork pull_request_target', async () => { + const originalEvent = mockGithubContext.eventName + const originalPayload = mockGithubContext.payload + try { + mockGithubContext.eventName = 'pull_request_target' + mockGithubContext.payload = forkPayload + // Simulate a rebase/fast-forward merge where the base tip (event SHA) + // equals the PR head SHA. The default self-checkout must still succeed. + mockGithubContext.sha = '1234567890123456789012345678901234567890' + const settings: IGitSourceSettings = await inputHelper.getInputs() + expect(settings.commit).toBe('1234567890123456789012345678901234567890') + } finally { + mockGithubContext.eventName = originalEvent + mockGithubContext.payload = originalPayload + } + }) + + it('refuses an explicit fork repository on pull_request_target', async () => { + const originalEvent = mockGithubContext.eventName + const originalPayload = mockGithubContext.payload + try { + mockGithubContext.eventName = 'pull_request_target' + mockGithubContext.payload = forkPayload + inputs.repository = 'attacker/fork' + await expect(inputHelper.getInputs()).rejects.toThrow( + /Refusing to check out fork pull request code/ + ) + } finally { + mockGithubContext.eventName = originalEvent + mockGithubContext.payload = originalPayload + } + }) + }) }) diff --git a/dist/index.js b/dist/index.js index b381bd2..cc25215 100644 --- a/dist/index.js +++ b/dist/index.js @@ -42191,12 +42191,19 @@ async function getInputs() { (getInput('allow-unsafe-pr-checkout') || 'false').toUpperCase() === 'TRUE'; core_debug(`allow unsafe PR checkout = ${result.allowUnsafePrCheckout}`); - assertSafePrCheckout({ - qualifiedRepository, - ref: result.ref, - commit: result.commit, - allowUnsafePrCheckout: result.allowUnsafePrCheckout - }); + // The default self-checkout (this repository with no explicit ref) always + // resolves to the trusted ref/commit GitHub set for the triggering event, so + // the fork-checkout guard only needs to run when the caller customized the + // repository or ref. + const isDefaultCheckout = isWorkflowRepository && !getInput('ref'); + if (!isDefaultCheckout) { + assertSafePrCheckout({ + qualifiedRepository, + ref: result.ref, + commit: result.commit, + allowUnsafePrCheckout: result.allowUnsafePrCheckout + }); + } return result; } diff --git a/src/input-helper.ts b/src/input-helper.ts index ce71cb3..87b2800 100644 --- a/src/input-helper.ts +++ b/src/input-helper.ts @@ -168,12 +168,19 @@ export async function getInputs(): Promise<IGitSourceSettings> { 'TRUE' core.debug(`allow unsafe PR checkout = ${result.allowUnsafePrCheckout}`) - unsafePrCheckoutHelper.assertSafePrCheckout({ - qualifiedRepository, - ref: result.ref, - commit: result.commit, - allowUnsafePrCheckout: result.allowUnsafePrCheckout - }) + // The default self-checkout (this repository with no explicit ref) always + // resolves to the trusted ref/commit GitHub set for the triggering event, so + // the fork-checkout guard only needs to run when the caller customized the + // repository or ref. + const isDefaultCheckout = isWorkflowRepository && !core.getInput('ref') + if (!isDefaultCheckout) { + unsafePrCheckoutHelper.assertSafePrCheckout({ + qualifiedRepository, + ref: result.ref, + commit: result.commit, + allowUnsafePrCheckout: result.allowUnsafePrCheckout + }) + } return result } |