espressif/openthread
1
0
Fork 0
mirror of https://github.com/espressif/openthread.git synced 2026-09-17 14:40:07 +00:00
Code Issues Packages Projects Releases Wiki Activity

[github-actions] fix pwn-request vulnerability in size.yml workflow (#12625)

Browse Source 
The size.yml workflow used pull_request_target with git checkout
FETCH_HEAD, which replaced the entire working directory (including
scripts) with untrusted fork code. Since pull_request_target grants
a read/write GITHUB_TOKEN even from public forks, and the workflow
had no top-level permissions restriction, this allowed arbitrary
code execution with write access to the repository.

Fix by:
1. Adding top-level permissions: contents: read (consistent with
   all other workflows in this repository).
2. Replacing `git checkout FETCH_HEAD` with a fetch-only approach
   that passes the PR merge commit SHA via the OT_SHA_NEW environment
   variable. The check-size script uses git-archive to extract code
   by SHA, so it does not need the working directory to be switched.
   This ensures ./script/check-size always runs from the base branch.
3. Updating check-size to accept OT_SHA_NEW from the environment,
   falling back to git rev-parse HEAD when not set (preserving
   existing behavior for push-triggered and local runs).
This commit is contained in:
Kevin Zhao
2026-03-05 16:27:33 -06:00
committed by GitHub
parent 66fbd918d7
commit 06e2cdbf5c
2 changed files with 7 additions and 4 deletions
Download Patch File Download Diff File Expand all files Collapse all files
.github/workflows/size.yml
+6 -3
View File
@@ -36,6 +36,9 @@ on:
branches: branches:
- 'main' - 'main'
permissions:
contents: read
concurrency: concurrency:
group: ${{ github.workflow }}-${{ github.event.pull_request.number || (github.repository == 'openthread/openthread' && github.run_id) || github.ref }} group: ${{ github.workflow }}-${{ github.event.pull_request.number || (github.repository == 'openthread/openthread' && github.run_id) || github.ref }}
cancel-in-progress: true cancel-in-progress: true
@@ -51,11 +54,11 @@ jobs:
egress-policy: audit # TODO: change to 'egress-policy: block' after couple of runs egress-policy: audit # TODO: change to 'egress-policy: block' after couple of runs
- uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0 - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
- name: Checkout Pull Request - name: Fetch Pull Request ref
if: ${{ github.event_name == 'pull_request_target' }} if: ${{ github.event_name == 'pull_request_target' }}
run: | run: |
git fetch origin pull/${{ github.event.pull_request.number }}/merge git fetch --depth 2 origin pull/${{ github.event.pull_request.number }}/merge
git checkout FETCH_HEAD echo "OT_SHA_NEW=$(git rev-parse FETCH_HEAD)" >> $GITHUB_ENV
- name: Run - name: Run
env: env:
PR_BODY: "${{ github.event.pull_request.body }}" PR_BODY: "${{ github.event.pull_request.body }}"
script/check-size
+1 -1
View File
@@ -32,7 +32,7 @@ set -euo pipefail
OT_TMP_DIR=/tmp/ot-size-report OT_TMP_DIR=/tmp/ot-size-report
readonly OT_TMP_DIR readonly OT_TMP_DIR
OT_SHA_NEW="$(git rev-parse HEAD)" OT_SHA_NEW="${OT_SHA_NEW:-$(git rev-parse HEAD)}"
readonly OT_SHA_NEW readonly OT_SHA_NEW
OT_SHA_OLD="${OT_SHA_OLD:-$(git cat-file -p "${OT_SHA_NEW}" | grep 'parent ' | head -n1 | cut -d' ' -f2)}" OT_SHA_OLD="${OT_SHA_OLD:-$(git cat-file -p "${OT_SHA_NEW}" | grep 'parent ' | head -n1 | cut -d' ' -f2)}"