3 ms·
It’s like putting curl -sSL https://example.com/install.sh https://example.com/install.sh | sh In your action. For sure happens.
by lixtra 1y ago
It’s like putting
curl -sSL https://example.com/install.sh https://example.com/install.sh | sh
In your action. For sure happens.
- woodruffw 1y agoYes; I would also consider that a bad idea. Two wrongs don't make a right (and a different wrong doesn't justify a broken policy elsewhere).
- masklinn 1y agoBeing able to filter or disable network access (aside from what github requires on their side to interact with actions) would definitely be useful, but AFAIK that's only an option for self-hosted runners and enterprise accounts.
- woodruffw 1y agoYep, I agree completely. It's unfortunate that self-hosted runners are otherwise so difficult to secure, since controlled ingress/egress is otherwise an extremely strong motivation for using them.