From d91864646545a6582b4045f190081d7be1682536 Mon Sep 17 00:00:00 2001 From: Joey Parrish Date: Mon, 16 Dec 2024 13:37:47 -0800 Subject: [PATCH] ci: Read build matrix JSON explicitly Because we used require() to read build-matrix.json, the file could be replaced with build-matrix.json.js, allowing code injection into our CI pipelines. This fixes this vulnerability by reading the JSON text with the fs module, then explicitly parsing it, rather than relying on require(). This also changes the location of the file, to match its location in other projects. --- .github/workflows/build.yaml | 6 ++++-- .github/workflows/build-matrix.json => build-matrix.json | 0 2 files changed, 4 insertions(+), 2 deletions(-) rename .github/workflows/build-matrix.json => build-matrix.json (100%) diff --git a/.github/workflows/build.yaml b/.github/workflows/build.yaml index fd92284c61a..df53eaea32e 100644 --- a/.github/workflows/build.yaml +++ b/.github/workflows/build.yaml @@ -52,16 +52,18 @@ jobs: id: configure shell: node {0} run: | + const fs = require('fs'); + const enableSelfHosted = ${{ inputs.self_hosted }}; + const buildMatrix = JSON.parse(fs.readFileSync("${{ github.workspace }}/build-matrix.json")); // Use enableSelfHosted to decide what the build matrix below should // include. - const {hosted, selfHosted} = require("${{ github.workspace }}/.github/workflows/build-matrix.json"); + const {hosted, selfHosted} = buildMatrix; const include = enableSelfHosted ? hosted.concat(selfHosted) : hosted; const os = include.map((config) => config.os); // Output JSON objects consumed by the build matrix below. - const fs = require('fs'); fs.writeFileSync(process.env.GITHUB_OUTPUT, [ `INCLUDE=${ JSON.stringify(include) }`, diff --git a/.github/workflows/build-matrix.json b/build-matrix.json similarity index 100% rename from .github/workflows/build-matrix.json rename to build-matrix.json