Skip to content

fix: prevent RCE via pull_request_target in maven-pr-builder.yml#3500

Open
prashantpiyush1111 wants to merge 1 commit into
iluwatar:masterfrom
prashantpiyush1111:fix/rce-only2
Open

fix: prevent RCE via pull_request_target in maven-pr-builder.yml#3500
prashantpiyush1111 wants to merge 1 commit into
iluwatar:masterfrom
prashantpiyush1111:fix/rce-only2

Conversation

@prashantpiyush1111
Copy link
Copy Markdown

Fixes #3478

Added a job-level if condition to restrict workflow execution
to PRs from the same repository only, preventing potential RCE
via fork PRs with write-scoped tokens.

@github-actions
Copy link
Copy Markdown

github-actions Bot commented Jun 2, 2026

PR Summary

Fixes #3478

Added a job-level if condition to restrict workflow execution to PRs from the same repository only, preventing potential RCE via fork PRs with write-scoped tokens.

Changes

File Summary
.github/workflows/maven-pr-builder.yml Introduced a guard on the 'Build on JDK 21' job by adding an if condition that ensures the PR build runs only when the PR head repo matches the target repository. This prevents the workflow from executing for fork PRs that could leverage write-scoped tokens, mitigating potential RCE via pull_request_target.

autogenerated by presubmit.ai

Copy link
Copy Markdown

@github-actions github-actions Bot left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🚨 Pull request needs attention.

Review Summary

Commits Considered (1)
  • 5a8229d: fix: prevent RCE via pull_request_target in maven-pr-builder.yml
Files Processed (1)
  • .github/workflows/maven-pr-builder.yml (1 hunk)
Actionable Comments (1)
  • .github/workflows/maven-pr-builder.yml [16-16]

    security: "Restrict workflow to in-repo PRs"

Skipped Comments (0)


name: Build on JDK 21
runs-on: ubuntu-22.04
if: github.event.pull_request.head.repo.full_name == github.repository
Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

This job-level guard prevents PRs from forks from running, which helps mitigate RCE risk when using write permissions in PR workflows. Ensure this aligns with all PR flow scenarios (e.g., pull_request_target vs pull_request) and consider adding a brief justification in the workflow header for future maintainers.

Copy link
Copy Markdown
Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Thanks for the suggestion! The if condition was added to prevent
fork PRs from running with write-scoped tokens, mitigating potential
RCE via pull_request_target. Will add a comment in the workflow if
maintainer requests it.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

Security finding — possible pull_request_target pattern (details on request)

1 participant