Skip to content

Commit d92909f

Browse files
authored
Treat PRs with agit flow as fork PRs when triggering actions. (#23884)
There is no fork concept in agit flow, anyone with read permission can push `refs/for/<target-branch>/<topic-branch>` to the repo. So we should treat it as a fork pull request because it may be from an untrusted user.
1 parent 9b416b2 commit d92909f

File tree

2 files changed

+17
-2
lines changed

2 files changed

+17
-2
lines changed

models/actions/run.go

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -36,7 +36,7 @@ type ActionRun struct {
3636
TriggerUser *user_model.User `xorm:"-"`
3737
Ref string
3838
CommitSHA string
39-
IsForkPullRequest bool
39+
IsForkPullRequest bool // If this is triggered by a PR from a forked repository or an untrusted user, we need to check if it is approved and limit permissions when running the workflow.
4040
NeedApproval bool // may need approval if it's a fork pull request
4141
ApprovedBy int64 `xorm:"index"` // who approved
4242
Event webhook_module.HookEventType

services/actions/notifier_helper.go

Lines changed: 16 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -152,6 +152,21 @@ func notify(ctx context.Context, input *notifyInput) error {
152152
return fmt.Errorf("json.Marshal: %w", err)
153153
}
154154

155+
isForkPullRequest := false
156+
if pr := input.PullRequest; pr != nil {
157+
switch pr.Flow {
158+
case issues_model.PullRequestFlowGithub:
159+
isForkPullRequest = pr.IsFromFork()
160+
case issues_model.PullRequestFlowAGit:
161+
// There is no fork concept in agit flow, anyone with read permission can push refs/for/<target-branch>/<topic-branch> to the repo.
162+
// So we can treat it as a fork pull request because it may be from an untrusted user
163+
isForkPullRequest = true
164+
default:
165+
// unknown flow, assume it's a fork pull request to be safe
166+
isForkPullRequest = true
167+
}
168+
}
169+
155170
for id, content := range workflows {
156171
run := &actions_model.ActionRun{
157172
Title: strings.SplitN(commit.CommitMessage, "\n", 2)[0],
@@ -161,7 +176,7 @@ func notify(ctx context.Context, input *notifyInput) error {
161176
TriggerUserID: input.Doer.ID,
162177
Ref: ref,
163178
CommitSHA: commit.ID.String(),
164-
IsForkPullRequest: input.PullRequest != nil && input.PullRequest.IsFromFork(),
179+
IsForkPullRequest: isForkPullRequest,
165180
Event: input.Event,
166181
EventPayload: string(p),
167182
Status: actions_model.StatusWaiting,

0 commit comments

Comments
 (0)