11–20 of 29 posts
The title suggests it is a Github issue but really it is https://github.com/composer/composer no? I would edit the title for clarity.
It's not an issue in GHA itself, this time. But if you are a composer user in GH, you should definitely be warned (and worried).
I was the reporter on this one. If you have Github Actions in your organization, disable them immediately if you're unsure which version of composer your Github Actions run.
Could you elaborate on this bit on why Github's secret masking doesn't work here: > GitHub Actions' built-in secret masker matches registered values as exact substrings. When the exception message is rendered by Symfony Console it may wrap, embed in In BaseIO.php line N: framing, or interleave with ANSI control sequences. So the masker does not redact, and the plaintext token reaches the log. What does this log rende…
For your example:
Line 34: ghs_fdsafdsarewqfdsa...
Is probably long enough in most cases to break to a new line.
Also, those blocks get "interleaved" like this:
ghs_fdsafdsarewqfdsafdsa
fdsardsardsafdsafs......
So there are now 's within the token, also breaking the substring matching.
This is kind of eye-opening for me -- I have never thought about how styled output like this could cause logging leakages.
GHA have always been a PITA for any serious DevOps; it's quite clear they were designed to integrate in 7 lines of code and then tell everyone who complains that they're doing it wrong. This does not surprise me.
Earlier quoted context omitted.
Could you elaborate on this bit on why Github's secret masking doesn't work here: > GitHub Actions' built-in secret masker matches registered values as exact substrings. When the exception message is rendered by Symfony Console it may wrap, embed in In BaseIO.php line N: framing, or interleave with ANSI control sequences. So the masker does not redact, and the plaintext token reaches the log. What does this log rende…
From what I can tell Symfony wraps these errors in a styled error block so it messes with GitHub's masking. For example, newlines breaking up the token are apparently enough to trick the masker since it's not a substring anymore. For your example: Line 34: ghs_fdsafdsarewqfdsa... Is probably long enough in most cases to break to a new line. Also, those blocks get "interleaved" like this: ghs_fdsafdsarewqfdsafdsa fdsa…
GHA have always been a PITA for any serious DevOps; it's quite clear they were designed to integrate in 7 lines of code and then tell everyone who complains that they're doing it wrong. This does not surprise me.
You've perfectly described how microsoft operates and how github actions is apparently based on AzureDevOps pipelines.
What is the security implication for private repos?
Earlier quoted context omitted.
Could you elaborate on this bit on why Github's secret masking doesn't work here: > GitHub Actions' built-in secret masker matches registered values as exact substrings. When the exception message is rendered by Symfony Console it may wrap, embed in In BaseIO.php line N: framing, or interleave with ANSI control sequences. So the masker does not redact, and the plaintext token reaches the log. What does this log rende…
From what I can tell Symfony wraps these errors in a styled error block so it messes with GitHub's masking. For example, newlines breaking up the token are apparently enough to trick the masker since it's not a substring anymore. For your example: Line 34: ghs_fdsafdsarewqfdsa... Is probably long enough in most cases to break to a new line. Also, those blocks get "interleaved" like this: ghs_fdsafdsarewqfdsafdsa fdsa…
the title is incorrect; it's not a github error but php composer's github action. cc @dang before people freak out