mirror of
https://github.com/ant-design/ant-design.git
synced 2026-02-09 02:49:18 +08:00
Security: Harden GitHub Actions workflows against PWN request attacks (#55942)
Co-authored-by: afc163 <507615+afc163@users.noreply.github.com> Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com> Co-authored-by: afc163 <afc163@gmail.com>
This commit is contained in:
Copilot
8
.github/CONTRIBUTING.md
vendored
8
.github/CONTRIBUTING.md
vendored
@@ -4,6 +4,10 @@ Want to contribute to Ant Design? There are a few things you need to know.
|
||||
|
||||
We wrote a **[contribution guide](https://ant.design/docs/react/contributing)** to help you get started.
|
||||
|
||||
## Security
|
||||
|
||||
If you're working with GitHub Actions workflows, please read our **[Workflows Security Guide](.github/WORKFLOWS_SECURITY.md)** to understand security best practices.
|
||||
|
||||
---
|
||||
|
||||
# 参与共建
|
||||
@@ -11,3 +15,7 @@ We wrote a **[contribution guide](https://ant.design/docs/react/contributing)**
|
||||
想要给 Ant Design 贡献自己的一份力量？
|
||||
|
||||
我们写了一份 **[贡献指南](https://ant.design/docs/react/contributing-cn)** 来帮助你开始。
|
||||
|
||||
## 安全
|
||||
|
||||
如果你需要修改 GitHub Actions 工作流，请阅读我们的 **[工作流安全指南](.github/WORKFLOWS_SECURITY.md)** 以了解安全最佳实践。
|
||||
|
||||
123
.github/WORKFLOWS_SECURITY.md
vendored
Normal file
123
.github/WORKFLOWS_SECURITY.md
vendored
Normal file
@@ -0,0 +1,123 @@
|
||||
# GitHub Actions Workflows Security
|
||||
|
||||
This document describes the security measures implemented in ant-design's GitHub Actions workflows to protect against common attack vectors, particularly the "PWN Request" vulnerability.
|
||||
|
||||
## Background: PWN Request Vulnerability
|
||||
|
||||
The "PWN Request" (or "Pull Request Target") vulnerability occurs when workflows:
|
||||
1. Use `pull_request_target`, `workflow_run`, or `issue_comment` triggers
|
||||
2. Check out code from untrusted sources (fork PRs)
|
||||
3. Execute that code with elevated privileges or access to secrets
|
||||
|
||||
This can allow attackers to:
|
||||
- Steal repository secrets
|
||||
- Execute remote code in the CI/CD environment
|
||||
- Modify repository contents
|
||||
- Compromise the supply chain
|
||||
|
||||
**Reference**: See [GitHub Security Lab - Preventing PWN Requests](https://securitylab.github.com/resources/github-actions-preventing-pwn-requests/)
|
||||
|
||||
## Security Principles Applied
|
||||
|
||||
### 1. Safe Use of `pull_request_target`
|
||||
|
||||
All workflows using `pull_request_target` follow these rules:
|
||||
|
||||
- ✅ **NEVER** check out PR code (`actions/checkout` with PR ref)
|
||||
- ✅ **NEVER** run `npm install` or similar with PR code
|
||||
- ✅ Only interact with PR metadata (comments, labels, status)
|
||||
- ✅ Use minimal permissions (explicitly defined per job)
|
||||
|
||||
**Safe workflows:**
|
||||
- `preview-start.yml` - Only comments on PRs
|
||||
- `pr-open-notify.yml` - Only sends notifications
|
||||
- `pr-open-check.yml` - Only validates PR content
|
||||
- `verify-files-modify.yml` - Only checks file modifications via API
|
||||
- `pr-check-merge.yml` - Only comments on branch merge PRs
|
||||
- `pr-contributor-welcome.yml` - Only comments on merged PRs
|
||||
- `visual-regression-diff-start.yml` - Only comments on PRs
|
||||
|
||||
### 2. Separation of Build and Deploy
|
||||
|
||||
We use the "build in PR, deploy in workflow_run" pattern:
|
||||
|
||||
**Build Phase** (uses `pull_request` trigger):
|
||||
- `preview-build.yml` - Builds site from PR code with restricted permissions
|
||||
- `visual-regression-diff-build.yml` - Generates screenshots from PR code
|
||||
- Uses `pull_request` trigger (no secrets, read-only repository access)
|
||||
- Uploads build artifacts (no secrets included)
|
||||
|
||||
**Deploy Phase** (uses `workflow_run` trigger):
|
||||
- `preview-deploy.yml` - Downloads artifacts and deploys
|
||||
- `visual-regression-diff-finish.yml` - Downloads artifacts and posts results
|
||||
- Only downloads artifacts, never checks out untrusted code
|
||||
- Has access to secrets for deployment
|
||||
- Validates PR numbers before use
|
||||
|
||||
### 3. Authorization Checks
|
||||
|
||||
Workflows that can modify repository state require authorization:
|
||||
|
||||
- ✅ `rebase.yml` - Restricts `/rebase` command to MEMBER, COLLABORATOR, or OWNER
|
||||
- ✅ `verify-files-modify.yml` - Checks contributor authority for protected paths
|
||||
- ✅ `pr-check-merge.yml` - Only runs for ant-design organization PRs
|
||||
|
||||
### 4. Minimal Permissions
|
||||
|
||||
All workflows follow the principle of least privilege:
|
||||
|
||||
```yaml
|
||||
permissions:
|
||||
contents: read # Default read-only access
|
||||
|
||||
jobs:
|
||||
specific-job:
|
||||
permissions:
|
||||
# Only grant what's needed
|
||||
issues: write
|
||||
pull-requests: write
|
||||
```
|
||||
|
||||
### 5. Pinned Action Versions
|
||||
|
||||
Critical actions are pinned to specific commit SHAs:
|
||||
- `actions-cool/verify-files-modify@9f38a3b3d324d4d92c88c8a946001522e17ad554`
|
||||
|
||||
This prevents supply chain attacks via compromised action updates.
|
||||
|
||||
### 6. Input Validation
|
||||
|
||||
All external inputs are validated:
|
||||
- PR numbers are validated as numeric before use
|
||||
- File paths are checked before operations
|
||||
- User associations are verified before privileged operations
|
||||
|
||||
## Workflow Security Checklist
|
||||
|
||||
When adding or modifying workflows, ensure:
|
||||
|
||||
- [ ] If using `pull_request_target`, NEVER check out PR code
|
||||
- [ ] If using `pull_request_target`, NEVER run untrusted code
|
||||
- [ ] If using `issue_comment` with code execution, check `author_association`
|
||||
- [ ] If using `workflow_run`, only download artifacts or check out base branch
|
||||
- [ ] Permissions are explicitly set to minimum required
|
||||
- [ ] Secrets are only used in trusted contexts
|
||||
- [ ] All user inputs are validated
|
||||
- [ ] Third-party actions are from trusted sources
|
||||
- [ ] Critical actions are pinned to commit SHAs
|
||||
|
||||
## Incident Response
|
||||
|
||||
If a security vulnerability is discovered:
|
||||
|
||||
1. Immediately disable the affected workflow
|
||||
2. Report to security team via [SECURITY.md](../SECURITY.md)
|
||||
3. Do not disclose publicly until patched
|
||||
4. Review all recent workflow runs for signs of exploitation
|
||||
|
||||
## References
|
||||
|
||||
- [GitHub Security Lab - Preventing PWN Requests](https://securitylab.github.com/resources/github-actions-preventing-pwn-requests/)
|
||||
- [GitHub Actions Security Best Practices](https://blog.gitguardian.com/github-actions-security-cheat-sheet/)
|
||||
- [OpenSSF - Mitigating Attack Vectors in GitHub Workflows](https://openssf.org/blog/2024/08/12/mitigating-attack-vectors-in-github-workflows/)
|
||||
- [PostHog - Shai Hulud Attack Post-Mortem](https://posthog.com/blog/nov-24-shai-hulud-attack-post-mortem)
|
||||
25
.github/workflows/rebase.yml
vendored
25
.github/workflows/rebase.yml
vendored
@@ -1,25 +0,0 @@
|
||||
name: Automatic Rebase
|
||||
|
||||
on:
|
||||
issue_comment:
|
||||
types: [created]
|
||||
|
||||
permissions:
|
||||
contents: read
|
||||
|
||||
jobs:
|
||||
rebase:
|
||||
permissions:
|
||||
contents: write # for cirrus-actions/rebase to push code to rebase
|
||||
pull-requests: read # for cirrus-actions/rebase to get info about PR
|
||||
name: Rebase
|
||||
if: github.event.issue.pull_request != '' && (contains(github.event.comment.body, '/rebase') || contains(github.event.comment.body, '\rebase'))
|
||||
runs-on: ubuntu-latest
|
||||
steps:
|
||||
- uses: actions/checkout@v6
|
||||
with:
|
||||
fetch-depth: 0
|
||||
- name: Automatic Rebase
|
||||
uses: cirrus-actions/rebase@1.8
|
||||
env:
|
||||
GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
|
||||
Reference in New Issue
Block a user