migrations/egui
1
0
Fork 0
mirror of https://github.com/emilk/egui.git synced 2026-09-02 06:40:06 -04:00
Code Activity

Fix vulnerability in the branch name check workflow (#7982)

Browse Source 
Before, a crafted branch name could be used to exfiltrate the github
token and wreak havoc 😅
This commit is contained in:
Lucas Meurer
2026-03-17 17:08:18 +01:00
committed by GitHub
parent f32727ddca
commit c09a8723b4
1 changed files with 8 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files

10
.github/workflows/enforce_branch_name.yml vendored
View File

@@ -4,17 +4,23 @@ on:
pull_request_target: pull_request_target:
types: [opened, reopened, synchronize] types: [opened, reopened, synchronize]
permissions:
issues: write
jobs: jobs:
check-source-branch: check-source-branch:
runs-on: ubuntu-latest runs-on: ubuntu-latest
timeout-minutes: 10 timeout-minutes: 10
steps: steps:
- name: Check PR source branch - name: Check PR source branch
env:
IS_FORK: ${{ github.event.pull_request.head.repo.fork }}
HEAD_REF: ${{ github.event.pull_request.head.ref }}
run: | run: |
# Check if PR is from a fork # Check if PR is from a fork
if [[ "${{ github.event.pull_request.head.repo.fork }}" == "true" ]]; then if [[ "$IS_FORK" == "true" ]]; then
# Check if PR is from the master/main branch of a fork # Check if PR is from the master/main branch of a fork
if [[ "${{ github.event.pull_request.head.ref }}" == "master" || "${{ github.event.pull_request.head.ref }}" == "main" ]]; then if [[ "$HEAD_REF" == "master" || "$HEAD_REF" == "main" ]]; then
echo "ERROR: Pull requests from the master/main branch of forks are not allowed, because it prevents maintainers from contributing to your PR" echo "ERROR: Pull requests from the master/main branch of forks are not allowed, because it prevents maintainers from contributing to your PR"
echo "Please create a feature branch in your fork and submit the PR from that branch instead." echo "Please create a feature branch in your fork and submit the PR from that branch instead."
exit 1 exit 1