-
-
Notifications
You must be signed in to change notification settings - Fork 49
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Add default GitHub token #195
Comments
Interesting! I did not know that. Can you take a look at #196 to see if it looks fine? |
Looks good to me! I don't know if there's a way to check that lychee is actually picking up the token (e.g. with verbose logging or similar), that would be the only thing I'd suggest just to make sure everything is working as we think it is :) |
mtardy
added a commit
to cilium/tetragon
that referenced
this issue
Oct 22, 2024
A user could create a branch with a particular name that would trigger a command injection because we use this input directly in the shell scripts generation. See more details in https://securitylab.github.com/resources/github-actions-untrusted-input/. This also updates the lychee action that no longer need an explicit GITHUB_TOKEN env variable lycheeverse/lychee-action#195 and reduce the permissions needed by the token in both check links workflows. Reported-by: Piergiorgio Ladisa <piergiorgio.ladisa@hotmail.it> Signed-off-by: Mahe Tardy <mahe.tardy@gmail.com>
mtardy
added a commit
to cilium/tetragon
that referenced
this issue
Oct 22, 2024
A user could create a branch with a particular name that would trigger a command injection because we use this input directly in the shell scripts generation. See more details in https://securitylab.github.com/resources/github-actions-untrusted-input/. This also updates the lychee action that no longer need an explicit GITHUB_TOKEN env variable lycheeverse/lychee-action#195 and reduce the permissions needed by the token in both check links workflows. Reported-by: Piergiorgio Ladisa <piergiorgio.ladisa@hotmail.it> Signed-off-by: Mahe Tardy <mahe.tardy@gmail.com>
mtardy
added a commit
to cilium/tetragon
that referenced
this issue
Oct 22, 2024
A user could create a branch with a particular name that would trigger a command injection because we use this input directly in the shell scripts generation. See more details in https://securitylab.github.com/resources/github-actions-untrusted-input/. This also updates the lychee action that no longer need an explicit GITHUB_TOKEN env variable lycheeverse/lychee-action#195 and reduce the permissions needed by the token in both check links workflows. Reported-by: Piergiorgio Ladisa <piergiorgio.ladisa@hotmail.it> Signed-off-by: Mahe Tardy <mahe.tardy@gmail.com>
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
If you define an action input for the GitHub token, you can include it by default, so that users don't need to write boilerplate like:
For an example, see https://github.com/styfle/cancel-workflow-action/blob/034d0e91921de4e82c4b8c958df266ca615543e8/action.yml#L15-L18 and https://github.com/peter-evans/create-issue-from-file/blob/ba0d2ca88c3d42f4e20ad4f1018fdb100f250b42/action.yml#LL4C1-L6C33
The text was updated successfully, but these errors were encountered: