self-hosted/woodpecker
1
0
Fork 0
mirror of https://github.com/woodpecker-ci/woodpecker.git synced 2025-11-29 21:48:14 +02:00
Code Issues Releases Activity

Add blocklist of environment variables who could alter execution of plugins (#3934)

Browse Source
This commit is contained in:
6543
2024-07-18 22:54:29 +02:00
committed by GitHub
parent 764329ed1d
commit 31a45e5633
3 changed files with 60 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files

7
pipeline/frontend/yaml/compiler/convert.go
View File

@@ -131,9 +131,14 @@ func (c *Compiler) createProcess(container *yaml_types.Container, stepType backe
return nil, err
}
toUpperTarget := strings.ToUpper(requested.Target)
if !environmentAllowed(toUpperTarget, stepType) {
continue
}
environment[requested.Target] = secretValue
// TODO: deprecated, remove in 3.x
environment[strings.ToUpper(requested.Target)] = secretValue
environment[toUpperTarget] = secretValue
}
if utils.MatchImage(container.Image, c.escalated...) && container.IsPlugin() {