4 ms·

I asked this question previously[0] but why are random PRs ran by CIs by default without user intervention? It would make more sense that by default PRs aren't

by qqii 6y ago

I asked this question previously[0] but why are random PRs ran by CIs by default without user intervention? It would make more sense that by default PRs aren't ran by default and an explicit whitelist or configuration option needs to be set. [0] in a discussion about the dangers of running your own CI server. I thought it were sensible if there was a permission config file which specified who can trigger which actions, where the CI uses the permissions of the last ran commit.

hnnameblah365 6y ago
I was surprised that Github Actions allows you to write scripts that anon users could trigger by opening PRs. But then it turns out this is how a lot of open source CI flows work. So maybe Github overlooked that they would become the biggest player overnight and be an obvious target? It's really strange to me. You would think anyone offering free anything on the internet knows there are people out there who will automate abusing your compute, storage, IPs, any resources you leave exposed. I've seen someone abuse a password reset form cuz they could advertise using that email addr '+' trick. (realuser+buy_our_scam@example.com). On a platform that didn't even have a million users. If it's free resources, there's no scam too unlikely.
oefrha 6y ago
What do you mean "by default"? By default workflows simply aren't run, not even when you push to master. You need to explicitly include the 'pull_request' or 'pull_request_target' event in the 'on' section of your workflow in order to build PRs. And you can implement a whitelist with reasonable ease if you want to. However, it turns out — who would have guessed — people do want to build random PRs, because 99% of PRs aren't jerks trying to mine crypto. --- Edit: To expand on the 'pull_request_target' event, it was introduced later and defends against running arbitrary unsanctioned workflows. It could have been introduced earlier, and maybe made more prominent, but there's a tradeoff.

by qqii 6y ago

hnnameblah365 6y ago

I was surprised that Github Actions allows you to write scripts that anon users could trigger by opening PRs. But then it turns out this is how a lot of open source CI flows work. So maybe Github overlooked that they would become the biggest player overnight and be an obvious target? It's really strange to me. You would think anyone offering free anything on the internet knows there are people out there who will automate abusing your compute, storage, IPs, any resources you leave exposed. I've seen someone abuse a password reset form cuz they could advertise using that email addr '+' trick. (realuser+buy_our_scam@example.com). On a platform that didn't even have a million users. If it's free resources, there's no scam too unlikely.

oefrha 6y ago

What do you mean "by default"? By default workflows simply aren't run, not even when you push to master. You need to explicitly include the 'pull_request' or 'pull_request_target' event in the 'on' section of your workflow in order to build PRs. And you can implement a whitelist with reasonable ease if you want to. However, it turns out — who would have guessed — people do want to build random PRs, because 99% of PRs aren't jerks trying to mine crypto. --- Edit: To expand on the 'pull_request_target' event, it was introduced later and defends against running arbitrary unsanctioned workflows. It could have been introduced earlier, and maybe made more prominent, but there's a tradeoff.