Repository navigation
fix: sec-check workflow permissions and fuzzing config - #6230
hivecommons-hive[bot] wants to merge 7 commits into
Conversation
kubestellar-prow
Bot
added
the
dco-signoff: yes
✅ Deploy Preview for kubestellar-docs ready!
To edit notification comments on pull requests, go to your Netlify project configuration. |
|
[APPROVALNOTIFIER] This PR is NOT APPROVED This pull-request has been approved by: The full list of commands accepted by this bot can be found here. DetailsNeeds approval from an approver in each of these files:Approvers can indicate their approval by writing |
github-actions
Bot
added
copilot
frontend
ci-cd
dependencies
kubestellar-prow
Bot
added
size/L
|
Hi @kubestellar-hive[bot]. Thanks for your PR. I'm waiting for a kubestellar member to verify that this patch is reasonable to test. If it is, they should reply with Once the patch is verified, the new status will be reflected by the I understand the commands that are listed here. DetailsInstructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. |
kubestellar-prow
Bot
added
size/XXL
hivecommons-hive
Bot
changed the title
![kubestellar-hive[bot]](https://github.githubassets.com/images/gravatars/gravatar-user-420.png){kind=avatar}
- technical-doc-writer.lock.yml: pin pre_activation job to contents:read + members:read (was inheriting workflow-level read-all without explicit block); narrow agent job from permissions:read-all to actions:read + contents:read + pull-requests:read (writes are only needed in safe_outputs/conclusion) Closes #6215 - sync-console-release-versions.yml: tighten workflow-level permissions from read-all to {} so any future job without an explicit block gets nothing by default; job-level contents:write + pull-requests:write unchanged Closes #6218 - create-version-branch.yml: add explanatory comment on permissions:{} intent (already minimal); no functional change Closes #6218 - Add .github/fuzzing/fuzz-mdx-sanitizer.ts: mutation-based fuzz harness for sanitizeHtmlForMdx() — checks that no <script>/<style> tags or event handlers survive after 20 000 mutated inputs - Add .github/workflows/fuzz-mdx.yml: weekly scheduled CI run of the harness (also triggers on PRs touching the sanitizer) Closes #6223 Signed-off-by: kubestellar-hive[bot] <kubestellar-hive[bot]@users.noreply.github.com>
353d588 to
cbcf65c
Compare
kubestellar-prow
Bot
added
size/L
Fuzz testing revealed three bypass paths in sanitizeHtmlForMdx: 1. img alt/src/title values were output verbatim, allowing <script>/<style> to survive inside attribute values (fixed by applying escapeAngle). 2. Unclosed <script> opening tags (no matching </script>) were not removed by the balanced-pair stripUntilStable pass (fixed with a follow-up replace). 3. Same gap for unclosed <style> opening tags. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com> Signed-off-by: kubestellar-hive[bot] <kubestellar-hive[bot]@users.noreply.github.com>
![github-advanced-security[bot]](https://avatars.githubusercontent.com/in/57789?s=60&v=4){kind=small}
Replace single-pass .replace() on unclosed <style> and <script> opening tags with stripUntilStable() to prevent multi-character bypass via nested/interleaved input (e.g. <sc<script>ript>). Fixes CodeQL CWE-116 alerts on lines 141 and 148 and the fuzz harness failure. Signed-off-by: scanner <andan02@gmail.com>
* Improve documentation homepage layout and content Signed-off-by: Shantanu675 <shantanudanej05@gmail.com> * Replace PanelLeftOpen button to improve UI Signed-off-by: Shantanu675 <shantanudanej05@gmail.com> --------- Signed-off-by: Shantanu675 <shantanudanej05@gmail.com>
Signed-off-by: github-actions[bot] <github-actions[bot]@users.noreply.github.com> Co-authored-by: github-actions[bot] <github-actions[bot]@users.noreply.github.com> Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
kubestellar-prow
Bot
added
dco-signoff: no
|
Thanks for your pull request. Before we can look at it, you'll need to add a 'DCO signoff' to your commits. 📝 Please follow instructions in the contributing guide to update your commits with the DCO Full details of the Developer Certificate of Origin can be found at developercertificate.org. The list of commits missing DCO signoff:
DetailsInstructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. I understand the commands that are listed here. |
github-actions
Bot
added
dco-signoff: yes
Summary
Fixes three sec-check advisories in a single PR:
actionlintCI workflow (.github/workflows/actionlint.yml) so that any future permission-block changes in workflows are automatically flagged by CI, addressing the ScorecardToken-Permissionsrecommendation.WORKFLOW_SYNC_TOKENincreate-version-branch.ymlandsync-console-release-versions.ymlwith short-lived GitHub App credentials (ACMM_APP_ID/ACMM_APP_PRIVATE_KEY), matching the pattern already used ingenerate-acmm-history.yml. Also addspermissions: read-allat workflow level tocreate-version-branch.yml..clusterfuzzlite/project.yaml+build.sh) and ajsfuzzharness (fuzz/sanitize-fuzz.js) targetingsanitizeHtmlForMdx(),removeCommentPatterns(), andstripUntilStable(). Aclusterfuzzlite.ymlCI workflow runs weekly batch fuzzing.Closes #6215
Closes #6218
Closes #6223