kumi/Android-Password-Store
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions 2

Switch back to pull_request to mitigate security issue (#1257)

Browse source 
According to advisory GHSL-2020-367 the changes I made to support pull_request_target make this repository vulnerable to attacks from any malicious forker

Signed-off-by: Harsh Shandilya <me@msfjarvis.dev>
This commit is contained in:
Harsh Shandilya 2020-12-22 00:32:56 -08:00 committed by GitHub
parent 37c8b416d5
commit 3c85930e6f
No known key found for this signature in database
GPG key ID: 4AEE18F83AFDEB23
1 changed files with 5 additions and 5 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

10
.github/workflows/pull_request.yml vendored
View file

@ -1,4 +1,4 @@
on: [pull_request_target]
on: [pull_request]
name: Check pull request
jobs:
@ -9,8 +9,8 @@ jobs:
api-level: [23, 29]
steps:
- name: Auto-cancel redundant workflow run
uses: technote-space/auto-cancel-redundant-workflow@f9dfa1c127a520e4d71b92892850f861fb861206
#- name: Auto-cancel redundant workflow run
# uses: technote-space/auto-cancel-redundant-workflow@f9dfa1c127a520e4d71b92892850f861fb861206
- name: Check if relevant files have changed
uses: actions/github-script@626af12fe9a53dc2972b48385e7fe7dec79145c9
@ -31,8 +31,8 @@ jobs:
- name: Checkout repository
if: ${{ steps.service-changed.outputs.result == 'true' }}
uses: actions/checkout@5a4ac9002d0be2fb38bd78e4b4dbde5606d7042f
with:
ref: refs/pull/${{ github.event.pull_request.number }}/merge
#with:
# ref: refs/pull/${{ github.event.pull_request.number }}/merge
- name: Copy CI gradle.properties
if: ${{ steps.service-changed.outputs.result == 'true' }}