35 ms·
There's a huge footgun in that article that has broader impact: > but it gets worse. since the workflow was checking out our PR code, we could replace the OWNE
by lostmsu 1y ago
There's a huge footgun in that article that has broader impact:
> but it gets worse. since the workflow was checking out our PR code, we could replace the OWNERS file with a symbolic link to ANY file on the runner. like, say, the github actions credentials file
So git allows committing soft links. So the issue above could affect almost any workflow.
- danudey 1y agoYes, but IIRC when you run `pull_request_target` the credentials are to the target repository - i.e. the one you're merging into. When you run `pull_request`, it's to the source repository, the one the attacker is in control of.