Skip to content

Commit e9ef6c7

Browse files
adonis0147adonis0147
authored
[chore](workflow) Fix security issues in Code Checks (apache#24761)
The workflow `Code Checks` needs write permissions granted by the event `pull_request_target` to comment on pull requests. However, if the workflow ran users' code, the malicious code would do some dangerous actions on our repository. The following changes are made in this PR: 1. Instead of applying patches, we use `sed` to modify the `entrypoint.sh` in action-sh-checker explicitly in the workflow. 2. Revoke the write permissions when generating `compile_commands.json` which is produced by executing the build script `build.sh`.
1 parent 016dd2a commit e9ef6c7

3 files changed

Lines changed: 50 additions & 32 deletions

File tree

‎.github/actions/patches/action-sh-checker.patch‎

Lines changed: 0 additions & 13 deletions
This file was deleted.

‎.github/workflows/code-checks.yml‎

Lines changed: 50 additions & 19 deletions
Original file line numberDiff line numberDiff line change
@@ -40,7 +40,7 @@ jobs:
4040
- name: Patch
4141
run: |
4242
pushd .github/actions/action-sh-checker >/dev/null
43-
git apply ../patches/action-sh-checker.patch
43+
sed -i 's/\[ "$GITHUB_EVENT_NAME" == "pull_request" \]/\[\[ "$GITHUB_EVENT_NAME" == "pull_request" || "$GITHUB_EVENT_NAME" == "pull_request_target" \]\]/' entrypoint.sh
4444
popd >/dev/null
4545
4646
- name: Run ShellCheck
@@ -51,10 +51,13 @@ jobs:
5151
sh_checker_comment: true
5252
sh_checker_exclude: .git .github ^docker ^thirdparty/src ^thirdparty/installed ^ui ^docs/node_modules ^tools/clickbench-tools ^extension ^output ^fs_brokers/apache_hdfs_broker/output (^|.*/)Dockerfile$ ^be/src/apache-orc ^be/src/clucene ^pytest
5353

54-
clang-tidy:
55-
name: "Clang Tidy"
54+
preparation:
55+
name: "Clang Tidy Preparation"
5656
if: ${{ github.event_name == 'pull_request_target' }}
5757
runs-on: ubuntu-22.04
58+
permissions: read-all
59+
outputs:
60+
should_check: ${{ steps.generate.outputs.should_check }}
5861
steps:
5962
- name: Checkout ${{ github.ref }} ( ${{ github.event.pull_request.head.sha }} )
6063
uses: actions/checkout@v3
@@ -73,28 +76,56 @@ jobs:
7376
- 'gensrc/thrift/**'
7477
7578
- name: Generate compile_commands.json
76-
if: ${{ steps.filter.outputs.be_changes == 'true' }}
79+
id: generate
7780
run: |
78-
export DEFAULT_DIR='/opt/doris'
81+
if [[ "${{ steps.filter.outputs.be_changes }}" == 'true' ]]; then
82+
export DEFAULT_DIR='/opt/doris'
7983
80-
mkdir "${DEFAULT_DIR}"
81-
wget https://github.com/amosbird/ldb_toolchain_gen/releases/download/v0.18/ldb_toolchain_gen.sh \
82-
-q -O /tmp/ldb_toolchain_gen.sh
83-
bash /tmp/ldb_toolchain_gen.sh "${DEFAULT_DIR}/ldb-toolchain"
84+
mkdir "${DEFAULT_DIR}"
85+
wget https://github.com/amosbird/ldb_toolchain_gen/releases/download/v0.18/ldb_toolchain_gen.sh \
86+
-q -O /tmp/ldb_toolchain_gen.sh
87+
bash /tmp/ldb_toolchain_gen.sh "${DEFAULT_DIR}/ldb-toolchain"
8488
85-
sudo DEBIAN_FRONTEND=noninteractive apt install --yes tzdata byacc
89+
sudo DEBIAN_FRONTEND=noninteractive apt install --yes tzdata byacc
8690
87-
pushd thirdparty
88-
curl -L https://github.com/apache/doris-thirdparty/releases/download/automation/doris-thirdparty-prebuilt-linux-x86_64.tar.xz \
89-
-o doris-thirdparty-prebuilt-linux-x86_64.tar.xz
90-
tar -xvf doris-thirdparty-prebuilt-linux-x86_64.tar.xz
91-
popd
91+
pushd thirdparty
92+
curl -L https://github.com/apache/doris-thirdparty/releases/download/automation/doris-thirdparty-prebuilt-linux-x86_64.tar.xz \
93+
-o doris-thirdparty-prebuilt-linux-x86_64.tar.xz
94+
tar -xvf doris-thirdparty-prebuilt-linux-x86_64.tar.xz
95+
popd
9296
93-
export PATH="${DEFAULT_DIR}/ldb-toolchain/bin/:$(pwd)/thirdparty/installed/bin/:${PATH}"
94-
DISABLE_JAVA_UDF=ON DORIS_TOOLCHAIN=clang OUTPUT_BE_BINARY=0 ./build.sh --be
97+
export PATH="${DEFAULT_DIR}/ldb-toolchain/bin/:$(pwd)/thirdparty/installed/bin/:${PATH}"
98+
DISABLE_JAVA_UDF=ON DORIS_TOOLCHAIN=clang ENABLE_PCH=OFF OUTPUT_BE_BINARY=0 ./build.sh --be
99+
fi
95100
96-
- name: Run clang-tidy review
101+
echo "should_check=${{ steps.filter.outputs.be_changes }}" >>${GITHUB_OUTPUT}
102+
103+
- name: Upload
104+
uses: actions/upload-artifact@v3
97105
if: ${{ steps.filter.outputs.be_changes == 'true' }}
106+
with:
107+
name: compile_commands
108+
path: ./be/build_Release/compile_commands.json
109+
110+
clang-tidy:
111+
name: "Clang Tidy"
112+
needs: preparation
113+
if: ${{ needs.preparation.outputs.should_check == 'true' }}
114+
runs-on: ubuntu-22.04
115+
steps:
116+
- name: Checkout ${{ github.ref }} ( ${{ github.event.pull_request.head.sha }} )
117+
uses: actions/checkout@v3
118+
with:
119+
ref: ${{ github.event.pull_request.head.sha }}
120+
submodules: recursive
121+
122+
- name: Download
123+
uses: actions/download-artifact@v3
124+
with:
125+
name: compile_commands
126+
path: ./be/build_Release
127+
128+
- name: Run clang-tidy review
98129
uses: ./.github/actions/clang-tidy-review
99130
id: review
100131
with:
@@ -103,4 +134,4 @@ jobs:
103134

104135
# clang-tidy review not required now
105136
# - if: steps.review.outputs.total_comments > 0
106-
# run: exit 1
137+
# run: exit 1

be/sonar-project.properties renamed to sonar-project.properties

File renamed without changes.

0 commit comments

Comments
 (0)