News for hackers. Stuff that matters.

A comment on GitHub Actions checkspelling community workflow GitHub_TOKEN leakage via symlink. Parent comment

Re:GitHub Actions checkspelling community workflow GitHub_TO... by bastardoperator on Thursday September 09, 2021 @01:51PM (#28472555)
This is every CI system on the planet

  echo ${PASSWORD} > file; cat file
And your password is now in the log file unmasked.
[ Parent | on HN ]
Re:GitHub Actions checkspelling community workflow GitHub_TO... by judge2020 on Thursday September 09, 2021 @01:54PM (#28472584)
No, it masks the output stream by searching for all secrets and censoring them.
[ Parent | on HN ]
Re:GitHub Actions checkspelling community workflow GitHub_TO... by VWWHFSfQ on Thursday September 09, 2021 @02:07PM (#28472726)
how does it know what are secrets? what if I base64 the password before printing it?
[ Parent | on HN ]
Re:GitHub Actions checkspelling community workflow GitHub_TO... by diamondo25 on Thursday September 09, 2021 @02:17PM (#28472847)
Thats what was said, it cannot detect that. If you rot13 it, you bypassed the protection.
[ Parent | on HN ]