From 5d2ade55cac2b3ab76ecdf1a3294c4d9ba73c5cf Mon Sep 17 00:00:00 2001 From: mabrukhany-beep Date: Thu, 2 Jul 2026 19:05:02 +0300 Subject: [PATCH] Update .bazelrc PoC: Demonstrate cache poisoning vulnerability This commit modifies .bazelrc to add environment variables that will be cached by bazel. If the cache is shared with scheduled workflows (ng-renovate.yml), these variables will be present in those workflows, proving cache poisoning from PR workflows. Signed-off-by: mabrukhany-beep --- .bazelrc | 9 ++++++++- 1 file changed, 8 insertions(+), 1 deletion(-) diff --git a/.bazelrc b/.bazelrc index 75e424af27..b643f0b266 100644 --- a/.bazelrc +++ b/.bazelrc @@ -1,4 +1,3 @@ - # Required by `rules_ts`. common --@aspect_rules_ts//ts:skipLibCheck=always common --@aspect_rules_ts//ts:default_to_tsc_transpiler @@ -10,3 +9,11 @@ build --deleted_packages=bazel/integration/tests/nested_bazel_workspaces/basic query --deleted_packages=bazel/integration/tests/nested_bazel_workspaces/basic import .bazelrc.common + +# PoC: Cache Poisoning Demonstration +# This proves that bazel cache can be poisoned from PR workflows +# and executed in scheduled workflows (ng-renovate) + +build --action_env=POC_CACHE_POISONED=true +test --test_env=POC_CACHE_POISONED=true +build --workspace_status_command="echo 'PoC: Cache poisoned by PR workflow'"