fix: prevent pwn-request RCE via Qodana workflow#3217
Open
dennisdoomen wants to merge 2 commits into
Open
Conversation
The previous code_quality.yml combined pull_request_target (which runs
with base-repo secrets) with actions/checkout using
ref: github.event.pull_request.head.sha (which checks out untrusted
contributor code). This is the classic 'pwn request' pattern: any external
contributor could submit a PR that executes arbitrary code with access to
QODANA_TOKEN.
Fix: implement the two-workflow safe pattern.
1. code_quality.yml (push / workflow_dispatch only)
- Handles pushes to main and develop, plus manual triggers.
- Checks out trusted code and uploads results with QODANA_TOKEN as before.
2. code_quality_pr.yml (pull_request - no secrets)
- Triggered by pull_request (NOT pull_request_target), so the job
runs with contributor code but has NO access to repository secrets.
- Runs Qodana analysis with upload-result: false.
- Saves results and PR number as a workflow artifact.
3. code_quality_upload.yml (workflow_run - secrets, no code checkout)
- Triggered when Qodana (PR) completes on the default branch,
so QODANA_TOKEN is available and no contributor code is ever executed.
- Downloads the artifact and uploads results to Qodana Cloud via the
Qodana CLI send command.
References:
- https://securitylab.github.com/research/github-actions-preventing-pwn-requests/
- https://www.jetbrains.com/help/qodana/github.html
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Security vulnerability fixed
The problem
.github/workflows/code_quality.ymlusedpull_request_target(which runs on the base repo with access to repository secrets) together withactions/checkoutusingref: github.event.pull_request.head.sha, which checks out untrusted contributor code in a privileged context. BecauseQODANA_TOKENis injected viaenv:, any PR from an external contributor could exfiltrate or abuse it — a classic pwn request RCE pattern.The fix: two-workflow pattern
The single vulnerable workflow is replaced with three:
code_quality.ymlpushtomain/develop,workflow_dispatchcode_quality_pr.ymlpull_requestcode_quality_upload.ymlworkflow_run(after PR analysis)Workflow 1 (
code_quality.yml) — unchanged behaviour for branch pushes and manual triggers. Checks out trusted code and uploads results to Qodana Cloud withQODANA_TOKEN.Workflow 2 (
code_quality_pr.yml) — triggered bypull_request(notpull_request_target). Runs with contributor code but has no access to secrets. Runs Qodana withupload-result: false, then saves the results directory and the PR number as a GitHub Actions artifact.Workflow 3 (
code_quality_upload.yml) — triggered byworkflow_runon completion of Workflow 2. Always runs on the default branch, soQODANA_TOKENis available. Never checks out any PR code. Downloads the artifact and uploads results to Qodana Cloud viaqodana send.References