skip running unsafe pr check if input is default (backport #2518 to releases/v6)

* block checking out fork pr for pull_request_target and workflow_run (#2454)

* block checking out fork pr for some events

* address copilot and reviewer feedback

* run prettier formatting

* build

* update urls

* update readme

* update description and url again

* edit url one more time

* update error wording (#2467)

__test__/input-helper.test.ts

@@ -155,4 +155,50 @@ describe('input-helper tests', () => {
     const settings: IGitSourceSettings = await inputHelper.getInputs()
     expect(settings.workflowOrganizationId).toBe(123456)
   })
+
+  describe('unsafe PR checkout guard', () => {
+    const forkPayload = {
+      repository: {id: 100},
+      pull_request: {
+        head: {
+          sha: '1234567890123456789012345678901234567890',
+          repo: {id: 200, full_name: 'attacker/fork'}
+        },
+        merge_commit_sha: 'aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa'
+      }
+    }
+
+    it('allows the default self-checkout on a fork pull_request_target', async () => {
+      const originalEvent = github.context.eventName
+      const originalPayload = github.context.payload
+      try {
+        github.context.eventName = 'pull_request_target'
+        github.context.payload = forkPayload as any
+        // Simulate a rebase/fast-forward merge where the base tip (event SHA)
+        // equals the PR head SHA. The default self-checkout must still succeed.
+        github.context.sha = '1234567890123456789012345678901234567890'
+        const settings: IGitSourceSettings = await inputHelper.getInputs()
+        expect(settings.commit).toBe('1234567890123456789012345678901234567890')
+      } finally {
+        github.context.eventName = originalEvent
+        github.context.payload = originalPayload
+      }
+    })
+
+    it('refuses an explicit fork repository on pull_request_target', async () => {
+      const originalEvent = github.context.eventName
+      const originalPayload = github.context.payload
+      try {
+        github.context.eventName = 'pull_request_target'
+        github.context.payload = forkPayload as any
+        inputs.repository = 'attacker/fork'
+        await expect(inputHelper.getInputs()).rejects.toThrow(
+          /Refusing to check out fork pull request code/
+        )
+      } finally {
+        github.context.eventName = originalEvent
+        github.context.payload = originalPayload
+      }
+    })
+  })
 })

dist/index.js

@@ -2150,12 +2150,19 @@ function getInputs() {
             (core.getInput('allow-unsafe-pr-checkout') || 'false').toUpperCase() ===
                 'TRUE';
         core.debug(`allow unsafe PR checkout = ${result.allowUnsafePrCheckout}`);
-        unsafePrCheckoutHelper.assertSafePrCheckout({
+        // The default self-checkout (this repository with no explicit ref) always
-            qualifiedRepository,
+        // resolves to the trusted ref/commit GitHub set for the triggering event, so
-            ref: result.ref,
+        // the fork-checkout guard only needs to run when the caller customized the
-            commit: result.commit,
+        // repository or ref.
-            allowUnsafePrCheckout: result.allowUnsafePrCheckout
+        const isDefaultCheckout = isWorkflowRepository && !core.getInput('ref');
-        });
+        if (!isDefaultCheckout) {
+            unsafePrCheckoutHelper.assertSafePrCheckout({
+                qualifiedRepository,
+                ref: result.ref,
+                commit: result.commit,
+                allowUnsafePrCheckout: result.allowUnsafePrCheckout
+            });
+        }
         return result;
     });
 }
@@ -2833,9 +2840,9 @@ function assertSafePrCheckout(input) {
     throw new Error(`Refusing to check out fork pull request code from a '${eventName}' workflow. ` +
         `This workflow runs with the base repository's GITHUB_TOKEN, secrets, default-branch ` +
         `cache scope, and runner access. Fetching and executing a fork's code in that trusted ` +
-        `context commonly leads to "pwn request" vulnerabilities. To opt in after reviewing ` +
+        `context commonly leads to "pwn request" vulnerabilities. To opt in, review the risks ` +
-        `the risks at https://gh.io/securely-using-pull_request_target, set ` +
+        `at https://gh.io/securely-using-pull_request_target and set 'allow-unsafe-pr-checkout: true' ` +
-        `'allow-unsafe-pr-checkout: true' on the actions/checkout step.`);
+        `on the actions/checkout step.`);
 }
 function pushIfSha(target, value) {
     if (typeof value === 'string' && value.length > 0) {

package-lock.json

@@ -14,7 +14,6 @@
         "@actions/github": "^6.0.0",
         "@actions/io": "^1.1.3",
         "@actions/tool-cache": "^2.0.1",
-        "flatted": "^3.4.2",
         "uuid": "^9.0.1"
       },
       "devDependencies": {
@@ -3591,10 +3590,10 @@
       }
     },
     "node_modules/flatted": {
-      "version": "3.4.2",
+      "version": "3.3.1",
-      "resolved": "https://registry.npmjs.org/flatted/-/flatted-3.4.2.tgz",
+      "resolved": "https://registry.npmjs.org/flatted/-/flatted-3.3.1.tgz",
-      "integrity": "sha512-PjDse7RzhcPkIJwy5t7KPWQSZ9cAbzQXcafsetQoD7sOJRQlGikNbx7yZp2OotDnJyrDcbyRq3Ttb18iYOqkxA==",
+      "integrity": "sha512-X8cqMLLie7KsNUDSdzeN8FYK9rEt4Dt67OsG/DNGnYTSDBG4uFAJFBnUeiV+zCVAvwFy56IjM9sH51jVaEhNxw==",
-      "license": "ISC"
+      "dev": true
     },
     "node_modules/for-each": {
       "version": "0.3.3",

package.json

@@ -33,7 +33,6 @@
     "@actions/github": "^6.0.0",
     "@actions/io": "^1.1.3",
     "@actions/tool-cache": "^2.0.1",
-    "flatted": "^3.4.2",
     "uuid": "^9.0.1"
   },
   "devDependencies": {

src/input-helper.ts

@@ -168,12 +168,19 @@ export async function getInputs(): Promise<IGitSourceSettings> {
     'TRUE'
   core.debug(`allow unsafe PR checkout = ${result.allowUnsafePrCheckout}`)
 
-  unsafePrCheckoutHelper.assertSafePrCheckout({
+  // The default self-checkout (this repository with no explicit ref) always
-    qualifiedRepository,
+  // resolves to the trusted ref/commit GitHub set for the triggering event, so
-    ref: result.ref,
+  // the fork-checkout guard only needs to run when the caller customized the
-    commit: result.commit,
+  // repository or ref.
-    allowUnsafePrCheckout: result.allowUnsafePrCheckout
+  const isDefaultCheckout = isWorkflowRepository && !core.getInput('ref')
-  })
+  if (!isDefaultCheckout) {
+    unsafePrCheckoutHelper.assertSafePrCheckout({
+      qualifiedRepository,
+      ref: result.ref,
+      commit: result.commit,
+      allowUnsafePrCheckout: result.allowUnsafePrCheckout
+    })
+  }
 
   return result
 }

src/unsafe-pr-checkout-helper.ts

@@ -75,9 +75,9 @@ export function assertSafePrCheckout(input: IUnsafePrCheckoutInput): void {
     `Refusing to check out fork pull request code from a '${eventName}' workflow. ` +
       `This workflow runs with the base repository's GITHUB_TOKEN, secrets, default-branch ` +
       `cache scope, and runner access. Fetching and executing a fork's code in that trusted ` +
-      `context commonly leads to "pwn request" vulnerabilities. To opt in after reviewing ` +
+      `context commonly leads to "pwn request" vulnerabilities. To opt in, review the risks ` +
-      `the risks at https://gh.io/securely-using-pull_request_target, set ` +
+      `at https://gh.io/securely-using-pull_request_target and set 'allow-unsafe-pr-checkout: true' ` +
-      `'allow-unsafe-pr-checkout: true' on the actions/checkout step.`
+      `on the actions/checkout step.`
   )
 }