2 ms·
This may not be a huge issue depending on mitigating controls but are they saying that anyone can submit a PR (containing anything) to Immich, tag the pr with `
by kevinsundar 1y ago
This may not be a huge issue depending on mitigating controls but are they saying that anyone can submit a PR (containing anything) to Immich, tag the pr with `preview` and have the contents of that PR hosted on https://pr-<num>.preview.internal.immich.cloud?
Doesn't that effectively let anyone host anything there?
- warkdarrior 1y agoExcellent idea for cost-free phishing.
- daemonologist 1y agoI think only collaborators can add labels on github, so not quite. Does seem a bit hazardous though (you could submit a legit PR, get the label, and then commit whatever you want?).
- ajross 1y agoExposure also extends not just to the owner of the PR but anyone with write access to the branch from which it was submitted. GitHub pushes are ssh-authenticated and often automated in many workflows.
- rixed 1y agoSo basically like https://docs.google.com/ https://docs.google.com/ ?
- jeroenhd 1y agoYes, except on Google Docs you can't make the document steal credentials or download malware by simply clicking on the link. It's more like sites.google.com.
- tgsovlerkhgsel 1y agoThat was my first thought - have the preview URLs possibly actually been abused through GitHub?
- bo0tzz 1y agoNo, it doesn't work at all for PRs from forks.