|
|
@@ -12,15 +12,24 @@ const gitHubWorkspace = path.resolve('/checkout-tests/workspace')
|
|
|
// Inputs for mock @actions/core
|
|
|
let inputs = {} as any
|
|
|
|
|
|
+// Replicate @actions/core getInput behavior: it trims whitespace by default
|
|
|
+// (String.prototype.trim(), which strips characters such as a leading U+FEFF BOM)
|
|
|
+// unless trimWhitespace is explicitly set to false.
|
|
|
+const getInputImpl = (name: string, options?: {trimWhitespace?: boolean}) => {
|
|
|
+ const val = inputs[name] ?? ''
|
|
|
+ if (options && options.trimWhitespace === false) {
|
|
|
+ return val
|
|
|
+ }
|
|
|
+ return typeof val === 'string' ? val.trim() : val
|
|
|
+}
|
|
|
+
|
|
|
// Shallow clone original @actions/github context
|
|
|
let originalContext = {...github.context}
|
|
|
|
|
|
describe('input-helper tests', () => {
|
|
|
beforeAll(() => {
|
|
|
// Mock getInput
|
|
|
- jest.spyOn(core, 'getInput').mockImplementation((name: string) => {
|
|
|
- return inputs[name]
|
|
|
- })
|
|
|
+ jest.spyOn(core, 'getInput').mockImplementation(getInputImpl as any)
|
|
|
|
|
|
// Mock error/warning/info/debug
|
|
|
jest.spyOn(core, 'error').mockImplementation(jest.fn())
|
|
|
@@ -139,8 +148,76 @@ describe('input-helper tests', () => {
|
|
|
expect(settings.commit).toBeFalsy()
|
|
|
})
|
|
|
|
|
|
+ it('does not reclassify a ref as sha when a BOM is prefixed', async () => {
|
|
|
+ // A fork branch named "<U+FEFF>" + 40 hex chars. core.getInput trims the
|
|
|
+ // BOM by default, which previously collapsed this into a bare SHA and
|
|
|
+ // bypassed the unsafe fork PR checkout guard.
|
|
|
+ inputs.ref = '\uFEFF522d932fae5296da51fdf431934425ecf891c6a2'
|
|
|
+ const settings: IGitSourceSettings = await inputHelper.getInputs()
|
|
|
+ expect(settings.commit).toBeFalsy()
|
|
|
+ expect(settings.ref).toBe('522d932fae5296da51fdf431934425ecf891c6a2')
|
|
|
+ })
|
|
|
+
|
|
|
+ it('treats a sha surrounded by ascii whitespace as a commit', async () => {
|
|
|
+ // ASCII whitespace can only come from the workflow author's YAML (git ref
|
|
|
+ // names cannot contain it), so trimming it and treating the value as a
|
|
|
+ // commit is safe.
|
|
|
+ inputs.ref = ' 1111111111222222222233333333334444444444 '
|
|
|
+ const settings: IGitSourceSettings = await inputHelper.getInputs()
|
|
|
+ expect(settings.ref).toBeFalsy()
|
|
|
+ expect(settings.commit).toBe('1111111111222222222233333333334444444444')
|
|
|
+ })
|
|
|
+
|
|
|
it('sets workflow organization ID', async () => {
|
|
|
const settings: IGitSourceSettings = await inputHelper.getInputs()
|
|
|
expect(settings.workflowOrganizationId).toBe(123456)
|
|
|
})
|
|
|
+
|
|
|
+ describe('unsafe PR checkout guard', () => {
|
|
|
+ const forkPayload = {
|
|
|
+ repository: {id: 100},
|
|
|
+ pull_request: {
|
|
|
+ head: {
|
|
|
+ sha: '1234567890123456789012345678901234567890',
|
|
|
+ repo: {id: 200, full_name: 'attacker/fork'}
|
|
|
+ },
|
|
|
+ merge_commit_sha: 'aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa'
|
|
|
+ }
|
|
|
+ }
|
|
|
+
|
|
|
+ it('allows the default self-checkout on a fork pull_request_target', async () => {
|
|
|
+ const originalEvent = github.context.eventName
|
|
|
+ const originalPayload = github.context.payload
|
|
|
+ const originalSha = github.context.sha
|
|
|
+ try {
|
|
|
+ github.context.eventName = 'pull_request_target'
|
|
|
+ github.context.payload = forkPayload as any
|
|
|
+ // Simulate a rebase/fast-forward merge where the base tip (event SHA)
|
|
|
+ // equals the PR head SHA. The default self-checkout must still succeed.
|
|
|
+ github.context.sha = '1234567890123456789012345678901234567890'
|
|
|
+ const settings: IGitSourceSettings = await inputHelper.getInputs()
|
|
|
+ expect(settings.commit).toBe('1234567890123456789012345678901234567890')
|
|
|
+ } finally {
|
|
|
+ github.context.eventName = originalEvent
|
|
|
+ github.context.payload = originalPayload
|
|
|
+ github.context.sha = originalSha
|
|
|
+ }
|
|
|
+ })
|
|
|
+
|
|
|
+ it('refuses an explicit fork repository on pull_request_target', async () => {
|
|
|
+ const originalEvent = github.context.eventName
|
|
|
+ const originalPayload = github.context.payload
|
|
|
+ try {
|
|
|
+ github.context.eventName = 'pull_request_target'
|
|
|
+ github.context.payload = forkPayload as any
|
|
|
+ inputs.repository = 'attacker/fork'
|
|
|
+ await expect(inputHelper.getInputs()).rejects.toThrow(
|
|
|
+ /Refusing to check out fork pull request code/
|
|
|
+ )
|
|
|
+ } finally {
|
|
|
+ github.context.eventName = originalEvent
|
|
|
+ github.context.payload = originalPayload
|
|
|
+ }
|
|
|
+ })
|
|
|
+ })
|
|
|
})
|
Aiqiao Yan