FYI: Using the action like in the example would make you vulnerable to pwn requests - Githubissues

Otherwa / CSVDash

Analyze and visualize CSV data with ease using this Streamlit-powered data analytics tool

https://csvdash.streamlit.app/

7 stars 4 forks source link

FYI: Using the action like in the example would make you vulnerable to pwn requests #17

Open ST-DDT opened 3 months ago

ST-DDT commented 3 months ago

The current run-nothing example is safe, but running anything in there that uses the source code is dangerous as it uses elevated permissions. I'll recommend rewriting/removing the example or raising awareness by adding a comment.

https://github.com/Otherwa/CSVDash/blob/2ac16996c1556b0e71bd0127976db320c2663a34/.github/workflows/labeler.yml#L18-L19 https://github.com/Otherwa/CSVDash/blob/2ac16996c1556b0e71bd0127976db320c2663a34/.github/workflows/labeler.yml#L24-L25

github-actions[bot] commented 3 months ago

Message that will be displayed on users' first issue