WIP: feat: add DefaultActionToken config #109

chizukicn · 2024-04-15T14:40:31Z

chizukicn commented

2024-04-15 14:40:31 +00:00

First-time contributor

This PR will add a new configuration to support access to private actions instances

chizukicn added 1 commit 2024-04-15 14:40:32 +00:00

feat: add config

checks / check and test (pull_request) Successful in 31s

Details

9a6a85dd98

chizukicn changed title from ~~feat: add `DefaultActionToken` config~~ to WIP: feat: add `DefaultActionToken` config

2024-04-15 14:54:10 +00:00

wolfogre requested changes 2024-04-16 02:54:18 +00:00

wolfogre left a comment

I don't think the code is enough. Could you please explain your design first?

The point is how to decide whether to pass the token to remote, what I can think of at the moment:

If the token is for a.com, what if uses: https://b.com/actions/demo? We should ensure that tokens are not leaked to another website it doesn't belong.
If the token is for a.com/org_1, what if uses: https://a.com/org_2/demo which is public? We should ensure that the token won't cause it to fail when cloning a public repo.

I'm not saying these are difficult to implement, it's just that because it involves authentication functions, we need to consider more to avoid security issues.

I don't think the code is enough. Could you please explain your design first? The point is how to decide whether to pass the token to remote, what I can think of at the moment: - If the token is for a.com, what if `uses: https://b.com/actions/demo`? We should ensure that tokens are not leaked to another website it doesn't belong. - If the token is for a.com/org_1, what if `uses: https://a.com/org_2/demo` which is public? We should ensure that the token won't cause it to fail when cloning a public repo. I'm not saying these are difficult to implement, it's just that because it involves authentication functions, we need to consider more to avoid security issues.

chizukicn commented

2024-04-16 10:20:25 +00:00

First-time contributor

I don't think the code is enough. Could you please explain your design first?

The point is how to decide whether to pass the token to remote, what I can think of at the moment:

If the token is for a.com, what if uses: https://b.com/actions/demo? We should ensure that tokens are not leaked to another website it doesn't belong.

If the token is for a.com/org_1, what if uses: https://a.com/org_2/demo which is public? We should ensure that the token won't cause it to fail when cloning a public repo.

I'm not saying these are difficult to implement, it's just that because it involves authentication functions, we need to consider more to avoid security issues.

Yes,this code is not engouth. A judgment needs to be made here so that the token can only be used from defaultActionsInstance

> I don't think the code is enough. Could you please explain your design first? > > The point is how to decide whether to pass the token to remote, what I can think of at the moment: > > - If the token is for a.com, what if `uses: https://b.com/actions/demo`? We should ensure that tokens are not leaked to another website it doesn't belong. > - If the token is for a.com/org_1, what if `uses: https://a.com/org_2/demo` which is public? We should ensure that the token won't cause it to fail when cloning a public repo. > > I'm not saying these are difficult to implement, it's just that because it involves authentication functions, we need to consider more to avoid security issues. Yes,this code is not engouth. A judgment needs to be made here so that the token can only be used from `defaultActionsInstance`