From 521f250e03a631423372f329ece04237d6648f9c Mon Sep 17 00:00:00 2001 From: Joey Parrish Date: Mon, 16 Dec 2024 13:55:18 -0800 Subject: [PATCH] ci: Read build matrix JSON explicitly Because we used require() to read build-matrix.json, the file could be replaced with build-matrix.json.js, allowing code injection into our CI pipelines. This fixes this vulnerability by reading the JSON text with the fs module, then explicitly parsing it, rather than relying on require(). This exploit was discovered by a researcher, and the researcher's activity was spotted within hours. Workflows were immediately suspended. No evidence has been found of any tampering in this repository or its releases. Issue #216 --- .github/workflows/build-and-test.yaml | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/.github/workflows/build-and-test.yaml b/.github/workflows/build-and-test.yaml index e5132ae..8298ee6 100644 --- a/.github/workflows/build-and-test.yaml +++ b/.github/workflows/build-and-test.yaml @@ -55,7 +55,8 @@ jobs: // Use ENABLE_SELF_HOSTED to decide what the build matrix below // should include. - const {hosted, selfHosted, pythonVersions} = require("${{ github.workspace }}/repo-src/build-matrix.json"); + const buildMatrix = JSON.parse(fs.readFileSync("${{ github.workspace }}/repo-src/build-matrix.json")); + const {hosted, selfHosted, pythonVersions} = buildMatrix; const devices = enableSelfHosted ? hosted.concat(selfHosted) : hosted; const matrix = [];