Repository navigation
Fork PR branch names can no longer run commands on the self-hosted review runner - #36
Merged
Merged
Conversation
…sted runner
gate-review.yml interpolated ${{ github.event.pull_request.head.ref }}
and PR label names straight into run:, on a public repo whose
pull_request jobs run on the self-hosted macOS gate-reviewer runner. A
fork branch named e.g. `x";curl …|sh;#` would have executed there once
a maintainer approved the run.
- Pass every event value through env: and quote the shell variables.
- Only same-repo PRs reach the self-hosted runner (head.repo ==
github.repository); fork PRs skip it entirely.
- Pin test.yml actions to commit SHAs.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
gate-review.ymlinterpolated${{ github.event.pull_request.head.ref }}(the PR branch name) and the PR's label names straight into arun:script. This repo is public, and that job runs on the self-hosted macOSgate-reviewerrunner. Anyone could open a fork PR from a branch named something likex";curl …|sh;#, and as soon as a maintainer approved the workflow run, that command would execute on the reviewer machine. Two mitigations were already in place: Actions requires approval for all external contributors, and the runner is offline right now. But the approval click is the only thing standing between a branch name and a shell.What changed
env:and is used as a quoted shell variable ("$BRANCH","$LABELS", …). The Python side already passes the branch togitas an argv list (noshell=True), so the CLI needs no change.head.repo.full_name == github.repository). Fork PRs never reach the runner. To review a fork PR, a maintainer pushes its branch to this repo.test.ymlactions are pinned to commit SHAs.Reviewer notes
gate-reviewstatus, so branch protection blocks them until a maintainer pushes the branch here. I think that's the right trade for a public repo with a self-hosted runner.gate-reviewerrunner online to post itsgate-reviewstatus.Verification
trigger,cleanup,testjobs intact).${{ }}expression remains inside anyrun:script.mainfound nothing in this repo's non-dev dependencies.Part of the 2026-10 cross-repo security audit remediation.
🤖 Generated with Claude Code