Comments (3)
I'd be interested in seeing a PR, although this crate's CI doesn't meaningfully interact with the outside world and I personally check every PR before approving a CI run, so I think the opportunities for exploitation are limited.
from spin-rs.
Hey Joshua, thanks for the reply. I'll be creating the PR shortly.
this crate's CI doesn't meaningfully interact with the outside world and I personally check every PR before approving a CI run, so I think the opportunities for exploitation are limited.
Your reviews on every PRs are really great, indeed help on the security on the repo and you should definitely continue doing that! But on the specific case of workflows external jobs it might not be enough, because the exploitation could actually come from changes on the code of the job you called.
To exemplify, note that on the rust.yml file you have uses: taiki-e/install-action@cargo-hack
. This part is running code from a version of the action defined on the https://github.com/taiki-e/install-action
repo. This could be dangerous for your repo because:
- AFAIU by reading the taiki-e repo, calling
uses: taiki-e/install-action@cargo-hack
does not pin the version of the code, so you would be always running the latest version. This means that you would be exposed in case this repo releases a compromised or erroneous code. - If you don't declare the permissions, you might be running the external code with write permissions. So the code could run
git commit
andgit push
towards your repo, for example. - Depending on your Branch protection settings, the
push
commands could succeed and push malicious code into you main branch.
The change that I initially purposed (updating workflow permissions) would already prevent this flow by limiting the permissions on the workflows. Additionally, my example went through some minor security risks that I would also be available and happy to help solving. Those would be:
- Specify the version of every external job you run.
- Determine branch protection rules for you main branch. E.g., there is a rule that requires PRs to merge code into the branch, preventing malicious direct pushes
Let me know your thoughts
from spin-rs.
As mentioned, I'm happy to review a PR that changes workflow permissions. Thanks for your time.
from spin-rs.
Related Issues (20)
- Inconsistent feature name HOT 2
- `lock_api` feature is not available in version 0.7.1 and 0.8.0. HOT 4
- Cannot borrow `lazy::Lazy<T>` mutably? HOT 5
- Remove `panicked` field from Once's Finish guard HOT 2
- Implement Once::get_mut_unchecked and Once::into_inner_unchecked HOT 4
- unwrap function in MutexGuard? HOT 4
- Request: Add support for atomic-polyfill HOT 7
- `Once::call_once` doesn't guarantee that the given closure is called only if this is the first time `call_once` has been called. HOT 2
- RwLock::try_read is unsound HOT 2
- MIRI build in CI is failing HOT 4
- portable_atomic feature does not compile HOT 2
- Why was spin 0.9.6 yanked? HOT 2
- Unsoundness in `Once::try_call_once()`
- Are `rwlock` and `spin_mutex` compatible with `portable_atomic`? HOT 11
- `Lazy` panics under bare metal environment HOT 10
- Implement a ticket lock for greater fairness HOT 2
- Add `std` feature with support for thread yielding HOT 1
- Switching to GitHub actions HOT 1
- Need a spinlock that never uses std::thread::yield_now HOT 9
Recommend Projects
-
React
A declarative, efficient, and flexible JavaScript library for building user interfaces.
-
Vue.js
🖖 Vue.js is a progressive, incrementally-adoptable JavaScript framework for building UI on the web.
-
Typescript
TypeScript is a superset of JavaScript that compiles to clean JavaScript output.
-
TensorFlow
An Open Source Machine Learning Framework for Everyone
-
Django
The Web framework for perfectionists with deadlines.
-
Laravel
A PHP framework for web artisans
-
D3
Bring data to life with SVG, Canvas and HTML. 📊📈🎉
-
Recommend Topics
-
javascript
JavaScript (JS) is a lightweight interpreted programming language with first-class functions.
-
web
Some thing interesting about web. New door for the world.
-
server
A server is a program made to process requests and deliver data to clients.
-
Machine learning
Machine learning is a way of modeling and interpreting data that allows a piece of software to respond intelligently.
-
Visualization
Some thing interesting about visualization, use data art
-
Game
Some thing interesting about game, make everyone happy.
Recommend Org
-
Facebook
We are working to build community through open source technology. NB: members must have two-factor auth.
-
Microsoft
Open source projects and samples from Microsoft.
-
Google
Google ❤️ Open Source for everyone.
-
Alibaba
Alibaba Open Source for everyone
-
D3
Data-Driven Documents codes.
-
Tencent
China tencent open source team.
from spin-rs.