mirror of
https://github.com/electron/electron.git
synced 2026-04-10 03:01:51 -04:00
9928c7d828
* fix: harden GitHub Actions against script injection vulnerabilities
Replace direct ${{ }} expression interpolation in run: blocks with
environment variables to prevent script injection attacks. Changes:
- archaeologist-dig.yml: move clone_url, head.sha, base.ref to env vars
- non-maintainer-dependency-change.yml: move user.login to env var
- issue-unlabeled.yml: move toJSON(labels) to env var
- issue-labeled.yml: move issue.number to env var
- pipeline-electron-lint.yml: validate chromium_revision format
- cipd-install/action.yml: move all inputs to env vars and quote them
- set-chromium-cookie/action.yml: reference secrets via $ENV_VAR
- Add security comments to all 5 pull_request_target workflows
https://claude.ai/code/session_01UUWmLxn5hyyxrhK8rGxU2s
* fix: allow version strings in chromium_revision validation
The previous regex `^[a-f0-9]+$` only matched git SHAs but
chromium_revision is a version string like `148.0.7741.0`.
Broaden to `^[a-zA-Z0-9._-]+$` which still blocks shell
metacharacters.
https://claude.ai/code/session_01UUWmLxn5hyyxrhK8rGxU2s
---------
Co-authored-by: Claude <noreply@anthropic.com>
93 lines
4.2 KiB
YAML
93 lines
4.2 KiB
YAML
name: Issue Labeled
|
|
|
|
on:
|
|
issues:
|
|
types: [labeled]
|
|
|
|
permissions: {}
|
|
|
|
jobs:
|
|
issue-labeled-with-status:
|
|
name: status/{confirmed,reviewed} label added
|
|
if: github.event.label.name == 'status/confirmed' || github.event.label.name == 'status/reviewed'
|
|
runs-on: ubuntu-latest
|
|
permissions:
|
|
contents: read
|
|
steps:
|
|
- name: Generate GitHub App token
|
|
uses: electron/github-app-auth-action@e14e47722ed120360649d0789e25b9baece12725 # v2.0.0
|
|
id: generate-token
|
|
with:
|
|
creds: ${{ secrets.ISSUE_TRIAGE_GH_APP_CREDS }}
|
|
org: electron
|
|
- name: Set status
|
|
uses: dsanders11/project-actions/edit-item@5767984408ccc6742f83acc8b8d8ea5e09f329af # v2.0.0
|
|
with:
|
|
token: ${{ steps.generate-token.outputs.token }}
|
|
project-number: 90
|
|
field: Status
|
|
field-value: ✅ Triaged
|
|
fail-if-item-not-found: false
|
|
issue-labeled-blocked:
|
|
name: blocked/* label added
|
|
if: startsWith(github.event.label.name, 'blocked/')
|
|
runs-on: ubuntu-latest
|
|
permissions:
|
|
contents: read
|
|
steps:
|
|
- name: Generate GitHub App token
|
|
uses: electron/github-app-auth-action@e14e47722ed120360649d0789e25b9baece12725 # v2.0.0
|
|
id: generate-token
|
|
with:
|
|
creds: ${{ secrets.ISSUE_TRIAGE_GH_APP_CREDS }}
|
|
org: electron
|
|
- name: Set status
|
|
uses: dsanders11/project-actions/edit-item@5767984408ccc6742f83acc8b8d8ea5e09f329af # v2.0.0
|
|
with:
|
|
token: ${{ steps.generate-token.outputs.token }}
|
|
project-number: 90
|
|
field: Status
|
|
field-value: 🛑 Blocked
|
|
fail-if-item-not-found: false
|
|
issue-labeled-blocked-need-repro:
|
|
name: blocked/need-repro label added
|
|
if: github.event.label.name == 'blocked/need-repro'
|
|
permissions:
|
|
issues: write # for actions-cool/issues-helper to update issues
|
|
runs-on: ubuntu-latest
|
|
steps:
|
|
- name: Check if comment needed
|
|
id: check-for-comment
|
|
env:
|
|
GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
|
|
GH_REPO: electron/electron
|
|
ISSUE_NUMBER: ${{ github.event.issue.number }}
|
|
run: |
|
|
set -eo pipefail
|
|
COMMENT_COUNT=$(gh issue view "$ISSUE_NUMBER" --comments --json comments | jq '[ .comments[] | select(.author.login == "electron-issue-triage" or .authorAssociation == "OWNER" or .authorAssociation == "MEMBER") | select(.body | startswith("<!-- blocked/need-repro -->")) ] | length')
|
|
if [[ $COMMENT_COUNT -eq 0 ]]; then
|
|
echo "SHOULD_COMMENT=1" >> "$GITHUB_OUTPUT"
|
|
fi
|
|
- name: Generate GitHub App token
|
|
if: ${{ steps.check-for-comment.outputs.SHOULD_COMMENT }}
|
|
uses: electron/github-app-auth-action@e14e47722ed120360649d0789e25b9baece12725 # v2.0.0
|
|
id: generate-token
|
|
with:
|
|
creds: ${{ secrets.ISSUE_TRIAGE_GH_APP_CREDS }}
|
|
- name: Create comment
|
|
if: ${{ steps.check-for-comment.outputs.SHOULD_COMMENT }}
|
|
uses: actions-cool/issues-helper@200c78641dbf33838311e5a1e0c31bbdb92d7cf0 # v3.8.0
|
|
with:
|
|
actions: 'create-comment'
|
|
token: ${{ steps.generate-token.outputs.token }}
|
|
body: |
|
|
<!-- blocked/need-repro -->
|
|
|
|
Hello @${{ github.event.issue.user.login }}. Thanks for reporting this and helping to make Electron better!
|
|
|
|
Would it be possible for you to make a standalone testcase with only the code necessary to reproduce the issue? For example, [Electron Fiddle](https://www.electronjs.org/fiddle) is a great tool for making small test cases and makes it easy to publish your test case to a [gist](https://gist.github.com) that Electron maintainers can use.
|
|
|
|
Stand-alone test cases make fixing issues go more smoothly: it ensure everyone's looking at the same issue, it removes all unnecessary variables from the equation, and it can also provide the basis for automated regression tests.
|
|
|
|
Now adding the https://github.com/electron/electron/labels/blocked%2Fneed-repro label for this reason. After you make a test case, please link to it in a followup comment. This issue will be closed in 10 days if the above is not addressed.
|