One comment about PIP/NPM packages - it's a very different level of threat
IMHO.
Installing and even running commands via PIP does not expose GITHUB_TOKEN
(and this is the real threat). It at most exposes the local build
environment to be hacked for the time of build but as long you are using
Gith
On Wed, Dec 30, 2020, 12:45 AM Jarek Potiuk
wrote:
> One comment about PIP/NPM packages - it's a very different level of threat
> IMHO.
>
> Installing and even running commands via PIP does not expose GITHUB_TOKEN
> (and this is the real threat). It at most exposes the local build
> environment t
>
>
> This is only sorry of correct. If you are using the standard checkout
> action and install a package from pypi/npm at a later step that package
> absolutely can push to the Apache repo when it runs in a push context (pr
> context it is read-only). This later step does not need the token passe
On Wed, Dec 30, 2020, 1:25 AM Jarek Potiuk wrote:
> >
> >
> > This is only sorry of correct. If you are using the standard checkout
> > action and install a package from pypi/npm at a later step that package
> > absolutely can push to the Apache repo when it runs in a push context (pr
> > context
I think this is a huge security problem a
I've opened a High Priority security ticket to Github
https://support.github.com/ticket/personal/0/964498 (it's personal so you
won't see it).
I am also immediately setting the "persist-credentials: false" to all our
checkout actions. This is really, bad i
Jarek>One comment about PIP/NPM packages - it's a very different level of
threat
Jarek>IMHO.
It is different, however, it is way more serious.
That is why it is wrong to make such a disruption for GitHub Actions while
we keep
the door open for NPM/PIP/Maven/Ant/... issues.
Jarek>Installing and e
> Jarek>Installing and even running commands via PIP does not expose
> GITHUB_TOKEN
> (and this is the real threat). It at most exposes the local build
>
> Running PIP at the ASF Jenkins instance (e.g. https://ci-beam.apache.org/
> )
> exposes ASF credentials to a malicious PIP package.
> Does that
I also sent incident report to secur...@apache.org for the checkout action.
If it is confirmed that it works this way, this is a really serious issue
IMHO.
On Wed, Dec 30, 2020 at 11:24 AM Jarek Potiuk wrote:
>
> Jarek>Installing and even running commands via PIP does not expose
>> GITHUB_TOKEN
Jarek>What credentials are you talking about?
For instance, asfNexusUsername/asfNexusPassword (see
https://cwiki.apache.org/confluence/display/INFRA/Gradle+Installations )
I assume there exists something like git-websites Jenkins node label that
has privileges to update project site (
https://cwik
Jarek>What credentials are you talking about?
Please report it to security@ then. If it works this way, this is serious
security threat IMHO.
On Wed, Dec 30, 2020 at 11:42 AM Vladimir Sitnikov <
sitnikov.vladi...@gmail.com> wrote:
> Jarek>What credentials are you talking about?
>
> For instance
FYI We looked at the source code of the checkout action and indeed it seems
it uses some kind of token, possibly GITHUB_TOKEN by simply using this:
https://github.com/actions/checkout/blob/main/src/input-helper.ts#L108
// Auth token
result.authToken = core.getInput('token', {required: true})
Got some feedback from GH support . It's both good and bad.
1) Indeed GITHUB_TOKEN is not available for actions that do not explicitly
get it passed to them
2) But it's much worse - the actions themselves can have (and even add) new
inputs and get the GITHUB_TOKEN set as default value via:
defa
FYI. I've filed two issues to GH via https://bounty.github.com/ - let's see
what their security teams do with those.
BTW. Brennan, if there is any reward, happy to share it with you :)
J.
On Wed, Dec 30, 2020 at 4:03 PM Jarek Potiuk
wrote:
> Got some feedback from GH support . It's both good
13 matches
Mail list logo
