Skip to content

Commit dc61089

Browse files
ZaperexZaperex
authored
chore: add additional security remediations (#4141)
* chore: add additional security remediations Signed-off-by: Frank Kong <[email protected]> rh-pre-commit.version: 2.3.2 rh-pre-commit.check-secrets: ENABLED * chore: add artifact sanitization Signed-off-by: Frank Kong <[email protected]> rh-pre-commit.version: 2.3.2 rh-pre-commit.check-secrets: ENABLED * chore: move permission to job level Signed-off-by: Frank Kong <[email protected]> rh-pre-commit.version: 2.3.2 rh-pre-commit.check-secrets: ENABLED
1 parent eb641ed commit dc61089

File tree

5 files changed

+41
-14
lines changed

5 files changed

+41
-14
lines changed

‎.github/actions/check-image-and-changes/action.yaml‎

Lines changed: 1 addition & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -40,8 +40,7 @@ runs:
4040
4141
# Check for [skip-build] tag in commit messages
4242
SKIP_BUILD_TAG=false
43-
COMMIT_MESSAGES=$(git log --format=%B "$BASE_COMMIT"..HEAD)
44-
if echo "$COMMIT_MESSAGES" | grep -q "\[skip-build\]"; then
43+
if git log --format=%B "$BASE_COMMIT"..HEAD | grep -qF "[skip-build]"; then
4544
echo "Found [skip-build] tag in commit messages."
4645
SKIP_BUILD_TAG=true
4746
fi

‎.github/workflows/pr-1.8.yaml‎

Lines changed: 8 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -36,6 +36,8 @@ jobs:
3636
build:
3737
name: Build with Node.js ${{ matrix.node-version }}
3838
runs-on: ubuntu-latest
39+
permissions:
40+
contents: read
3941
strategy:
4042
matrix:
4143
node-version: [22]
@@ -60,6 +62,8 @@ jobs:
6062
- name: Setup local Turbo cache
6163
if: ${{ steps.check-image.outputs.is_skipped != 'true' }}
6264
uses: dtinth/setup-github-actions-caching-for-turbo@cc723b4600e40a6b8815b65701d8614b91e2669e # v1
65+
with:
66+
cache-prefix: turbogha-pr-${{ github.event.number }}
6367

6468
- name: Use app-config.example.yaml
6569
if: ${{ steps.check-image.outputs.is_skipped != 'true' }}
@@ -78,6 +82,8 @@ jobs:
7882
test:
7983
name: Test with Node.js ${{ matrix.node-version }}
8084
runs-on: ubuntu-latest
85+
permissions:
86+
contents: read
8187
strategy:
8288
matrix:
8389
node-version: [22]
@@ -101,6 +107,8 @@ jobs:
101107
- name: Setup local Turbo cache
102108
if: ${{ steps.check-image.outputs.is_skipped != 'true' }}
103109
uses: dtinth/setup-github-actions-caching-for-turbo@cc723b4600e40a6b8815b65701d8614b91e2669e # v1
110+
with:
111+
cache-prefix: turbogha-pr-${{ github.event.number }}
104112

105113
- name: Use app-config.example.yaml
106114
if: ${{ steps.check-image.outputs.is_skipped != 'true' }}

‎.github/workflows/pr-build-image.yaml‎

Lines changed: 5 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -16,6 +16,7 @@ name: PR Build Image (Hermetic)
1616

1717
on:
1818
pull_request:
19+
1920
concurrency:
2021
group: ${{ github.workflow }}-${{ github.event.number || github.event.pull_request.head.ref }}
2122
cancel-in-progress: true
@@ -28,7 +29,8 @@ jobs:
2829
build-image:
2930
name: Build Image
3031
runs-on: ubuntu-latest
31-
32+
permissions:
33+
contents: read
3234
steps:
3335
- name: Checkout
3436
uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
@@ -65,8 +67,8 @@ jobs:
6567
if: ${{ steps.check-image.outputs.is_skipped != 'true' }}
6668
run: |
6769
git remote add base-origin https://github.com/${{ github.repository }} || true
68-
git config user.name "${{ github.event.pull_request.user.login }}"
69-
git config user.email "${{ github.event.pull_request.user.email }}"
70+
git config user.name "github-actions[bot]"
71+
git config user.email "github-actions[bot]@users.noreply.github.com"
7072
echo "Updating PR with latest commits from ${{ github.event.pull_request.base.ref }} ..."
7173
git fetch base-origin ${{ github.event.pull_request.base.ref }}
7274
git merge --no-edit base-origin/${{ github.event.pull_request.base.ref }}

‎.github/workflows/pr-podman-push.yaml‎

Lines changed: 19 additions & 9 deletions
Original file line numberDiff line numberDiff line change
@@ -79,12 +79,21 @@ jobs:
7979
id: check-skip
8080
run: |
8181
if [ -f "./rhdh-skip-artifacts/isSkipped.txt" ]; then
82-
IS_SKIPPED=$(cat ./rhdh-skip-artifacts/isSkipped.txt)
83-
echo "Found skip status: $IS_SKIPPED"
82+
IS_SKIPPED_RAW=$(cat ./rhdh-skip-artifacts/isSkipped.txt)
83+
84+
# Sanitize: Allow only 'true' or 'false', default to false if unknown to skip artifact download in case of injection
85+
if [[ "$IS_SKIPPED_RAW" == "false" ]]; then
86+
IS_SKIPPED="false"
87+
else
88+
IS_SKIPPED="true"
89+
fi
90+
91+
echo "Found skip status: $IS_SKIPPED_RAW"
92+
echo "Sanitized skip status: $IS_SKIPPED"
8493
echo "is_skipped=$IS_SKIPPED" >> $GITHUB_OUTPUT
8594
else
86-
echo "Skip status artifact not found, proceeding with push"
87-
echo "is_skipped=false" >> $GITHUB_OUTPUT
95+
echo "Skip status artifact not found, skipping push"
96+
echo "is_skipped=true" >> $GITHUB_OUTPUT
8897
fi
8998
9099
- name: Download Image Artifacts
@@ -117,12 +126,13 @@ jobs:
117126
podman images
118127
119128
echo "Full tags from metadata:"
120-
echo "$TAGS_LIST"
129+
printf '%s\n' "$TAGS_LIST"
121130
122-
# Use a heredoc since TAGS_LIST contains newlines
123-
echo "tags<<EOF" >> $GITHUB_OUTPUT
124-
echo "$TAGS_LIST" >> $GITHUB_OUTPUT
125-
echo "EOF" >> $GITHUB_OUTPUT
131+
# SECURITY: Use a random delimiter to prevent output injection from artifact poisoning
132+
DELIMITER=$(openssl rand -hex 16)
133+
echo "tags<<$DELIMITER" >> $GITHUB_OUTPUT
134+
printf '%s\n' "$TAGS_LIST" >> $GITHUB_OUTPUT
135+
echo "$DELIMITER" >> $GITHUB_OUTPUT
126136
127137
- name: Push Images
128138
if: ${{ steps.check-skip.outputs.is_skipped != 'true' }}

‎.github/workflows/pr.yaml‎

Lines changed: 8 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -34,6 +34,8 @@ jobs:
3434
build:
3535
name: Build with Node.js ${{ matrix.node-version }}
3636
runs-on: ubuntu-latest
37+
permissions:
38+
contents: read
3739
strategy:
3840
matrix:
3941
node-version: [22]
@@ -58,6 +60,8 @@ jobs:
5860
- name: Setup local Turbo cache
5961
if: ${{ steps.check-image.outputs.is_skipped != 'true' }}
6062
uses: dtinth/setup-github-actions-caching-for-turbo@cc723b4600e40a6b8815b65701d8614b91e2669e # v1
63+
with:
64+
cache-prefix: turbogha-pr-${{ github.event.number }}
6165

6266
- name: Use app-config.example.yaml
6367
if: ${{ steps.check-image.outputs.is_skipped != 'true' }}
@@ -76,6 +80,8 @@ jobs:
7680
test:
7781
name: Test with Node.js ${{ matrix.node-version }}
7882
runs-on: ubuntu-latest
83+
permissions:
84+
contents: read
7985
strategy:
8086
matrix:
8187
node-version: [22]
@@ -99,6 +105,8 @@ jobs:
99105
- name: Setup local Turbo cache
100106
if: ${{ steps.check-image.outputs.is_skipped != 'true' }}
101107
uses: dtinth/setup-github-actions-caching-for-turbo@cc723b4600e40a6b8815b65701d8614b91e2669e # v1
108+
with:
109+
cache-prefix: turbogha-pr-${{ github.event.number }}
102110

103111
- name: Use app-config.example.yaml
104112
if: ${{ steps.check-image.outputs.is_skipped != 'true' }}

0 commit comments

Comments
 (0)