bugGNU Octave - Bugs: bug #62461, [GitHub] [Workflows] GITHUB_TOKEN...

 
 

bug #62461: [GitHub] [Workflows] GITHUB_TOKEN with too much permissions

Submitter:  None
Submitted:  Sat 14 May 2022 05:02:35 PM UTC
   
 
Category:  Test Suite Severity:  3 - Normal
Priority:  5 - Normal Item Group:  None
Status:  None Assigned to:  None
Originator Name:  Originator Email:  -email is unavailable-
Open/Closed:  * Open Release:  * dev
Operating System:  * Any Fixed Release:  None
Planned Release:  None
* Mandatory Fields

Add a New Comment Rich Markup
   

Mon 16 May 2022 09:14:11 AM UTC, comment #1: 

Thanks for your report.

I guess you are referring to the read-only mirror of Octave on GitHub here:
https://github.com/gnu-octave/octave

I'm trying to come up with a scenario where the permissions of GITHUB_TOKEN could actually become an issue. Could you please elaborate?

Anyway, restricting the permissions per workflow file would probably not hurt. But if a malicious party gained access to triggering a (modified) workflow run, they could probably also change the permissions in those files to anything they'd like anyway...

Markus Mützel <mmuetzel>
Group administrator
Sat 14 May 2022 05:02:35 PM UTC, original submission:  

### Detailed Description

In the public repository on GitHub, the workflows have too many permissions, this is, they have write access for nearly feature.  This should be considered a serious security issue since it gives the workflow control over the entire repository, including changing files as well as authoring and approving pull requests.

Please consider to reduce the permissions you grant your workflows.

### Suggested Fix

In order to reduce the permissions of the workflow, just add the following lines to the top level of its source file:

```
permissions:
  contents: read
```

This will set the permissions to read-only for the repository and discard all further permissions, this is, the workflow will be not allowed anymore to approve pull requests, for instance.

For more details, please take a look at the GitHub Documentation for this feature:  https://docs.github.com/en/actions/using-workflows/workflow-syntax-for-github-actions?azure-portal=true#permissions.

Anonymous

 

(Note: upload size limit is set to 16384 kB, after insertion of the required escape characters.)

Attach Files:
   
   
Comment:
   

No files currently attached

 

Depends on the following items: None found

Items that depend on this one: None found

 

Carbon-Copy List
  • -email is unavailable- added by mmuetzel (Posted a comment)
  •  

    There are 0 votes so far. Votes easily highlight which items people would like to see resolved in priority, independently of the priority of the item set by tracker managers.

    Only group members can vote.

     

    No changes have been made to this item

    Back to the top

    Powered by Savane 3.13-4448.
    Corresponding source code