pull_request_target is not secure

quarkusio / quarkusio.github.io

Website for Quarkus project

https://quarkus.io

164 stars 380 forks source link

pull_request_target is not secure #829

Open jeffmaury opened 3 years ago

jeffmaury commented 3 years ago

https://github.com/quarkusio/quarkusio.github.io/blob/89aa226c7f6b474a614806f542cc413eb5a34b20/.github/workflows/preview.yml#L4

Would allow someone to submit a PR that dumps all secrets in the run log

jeffmaury commented 3 years ago

See this from GitHub security team: https://securitylab.github.com/research/github-actions-preventing-pwn-requests

maxandersen commented 7 months ago

@gsmet wdyt? should we have github bot add "preview" label on prs that only touch non-yml content and otherwise require a "preview" label for this to run to avoid this issue?