Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Fix security issues, remove build from commit option #2189

Merged
merged 8 commits into from
May 25, 2022

Conversation

safinsaf
Copy link
Contributor

@safinsaf safinsaf commented May 11, 2022

Description of the Change

  1. Set context points accessible by user to env vars
  2. Set read-all permissions to jobs other than deploy
  3. Restrict changing dependency files from forks

Issue

https://hackerone.com/reports/1548870

Benefits

Remove potential injection

Possible Drawbacks

Usage Examples or Tests [optional]

Alternate Designs [optional]

Signed-off-by: safinsaf <safinsaft@gmail.com>
@safinsaf safinsaf requested a review from ryjones May 11, 2022 03:30
ryjones
ryjones previously approved these changes May 11, 2022
@ryjones
Copy link
Member

ryjones commented May 11, 2022

@nikitastupin take a look?

Signed-off-by: safinsaf <safinsaft@gmail.com>
Signed-off-by: safinsaf <safinsaft@gmail.com>
Signed-off-by: safinsaf <safinsaft@gmail.com>
Signed-off-by: safinsaf <safinsaft@gmail.com>
Signed-off-by: safinsaf <safinsaft@gmail.com>
Signed-off-by: safinsaf <safinsaft@gmail.com>
@safinsaf safinsaf requested a review from Cre-eD May 24, 2022 13:34
Cre-eD
Cre-eD previously approved these changes May 24, 2022
Signed-off-by: safinsaf <safinsaft@gmail.com>
@safinsaf safinsaf changed the title Remove running build from comment Fix security issues, remove build from commit option May 25, 2022
@safinsaf safinsaf requested a review from Cre-eD May 25, 2022 08:38
@safinsaf safinsaf merged commit 8593311 into main May 25, 2022
@safinsaf safinsaf deleted the hotfix/iroha-fork-injection branch May 25, 2022 10:36
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

3 participants