block checking out fork pr for some events

README.md

@@ -162,11 +162,8 @@ Please refer to the [release page](https://github.com/actions/checkout/releases/
     github-server-url: ''
 
     # Required to check out fork pull request code from a workflow triggered by
-    # `pull_request_target` or `workflow_run`. These workflows run with the base
-    # repository's GITHUB_TOKEN, secrets, default-branch cache scope, and runner
-    # access; fetching and executing a fork's code in that trusted context commonly
-    # leads to "pwn request" vulnerabilities. Set to `true` only after reviewing the
-    # risks at https://gh.io/securely-using-pull_request_target.
+    # `pull_request_target` or `workflow_run`. See [Pwn Requests](todo:need-link) for
+    # the risks. Set to `true` only after reviewing the risks.
     # Default: false
     allow-unsafe-pr-checkout: ''
 ```

__test__/input-helper.test.ts

@@ -12,24 +12,15 @@ const gitHubWorkspace = path.resolve('/checkout-tests/workspace')
 // Inputs for mock @actions/core
 let inputs = {} as any
 
-// Replicate @actions/core getInput behavior: it trims whitespace by default
-// (String.prototype.trim(), which strips characters such as a leading U+FEFF BOM)
-// unless trimWhitespace is explicitly set to false.
-const getInputImpl = (name: string, options?: {trimWhitespace?: boolean}) => {
-  const val = inputs[name] ?? ''
-  if (options && options.trimWhitespace === false) {
-    return val
-  }
-  return typeof val === 'string' ? val.trim() : val
-}
-
 // Shallow clone original @actions/github context
 let originalContext = {...github.context}
 
 describe('input-helper tests', () => {
   beforeAll(() => {
     // Mock getInput
-    jest.spyOn(core, 'getInput').mockImplementation(getInputImpl as any)
+    jest.spyOn(core, 'getInput').mockImplementation((name: string) => {
+      return inputs[name]
+    })
 
     // Mock error/warning/info/debug
     jest.spyOn(core, 'error').mockImplementation(jest.fn())
@@ -160,86 +151,8 @@ describe('input-helper tests', () => {
     expect(settings.commit).toBeFalsy()
   })
 
-  it('does not reclassify a ref as sha when a BOM is prefixed', async () => {
-    // A fork branch named "<U+FEFF>" + 40 hex chars. core.getInput trims the
-    // BOM by default, which previously collapsed this into a bare SHA and
-    // bypassed the unsafe fork PR checkout guard.
-    inputs.ref = '\uFEFF522d932fae5296da51fdf431934425ecf891c6a2'
-    const settings: IGitSourceSettings = await inputHelper.getInputs()
-    expect(settings.commit).toBeFalsy()
-    expect(settings.ref).toBe('522d932fae5296da51fdf431934425ecf891c6a2')
-  })
-
-  it('does not reclassify a sha-256 ref as sha when a BOM is prefixed', async () => {
-    inputs.ref =
-      '\uFEFF1111111111222222222233333333334444444444555555555566666666667777'
-    const settings: IGitSourceSettings = await inputHelper.getInputs()
-    expect(settings.commit).toBeFalsy()
-    expect(settings.ref).toBe(
-      '1111111111222222222233333333334444444444555555555566666666667777'
-    )
-  })
-
-  it('treats a sha surrounded by ascii whitespace as a commit', async () => {
-    // ASCII whitespace can only come from the workflow author's YAML (git ref
-    // names cannot contain it), so trimming it and treating the value as a
-    // commit is safe.
-    inputs.ref = '  1111111111222222222233333333334444444444  '
-    const settings: IGitSourceSettings = await inputHelper.getInputs()
-    expect(settings.ref).toBeFalsy()
-    expect(settings.commit).toBe('1111111111222222222233333333334444444444')
-  })
-
   it('sets workflow organization ID', async () => {
     const settings: IGitSourceSettings = await inputHelper.getInputs()
     expect(settings.workflowOrganizationId).toBe(123456)
   })
-
-  describe('unsafe PR checkout guard', () => {
-    const forkPayload = {
-      repository: {id: 100},
-      pull_request: {
-        head: {
-          sha: '1234567890123456789012345678901234567890',
-          repo: {id: 200, full_name: 'attacker/fork'}
-        },
-        merge_commit_sha: 'aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa'
-      }
-    }
-
-    it('allows the default self-checkout on a fork pull_request_target', async () => {
-      const originalEvent = github.context.eventName
-      const originalPayload = github.context.payload
-      const originalSha = github.context.sha
-      try {
-        github.context.eventName = 'pull_request_target'
-        github.context.payload = forkPayload as any
-        // Simulate a rebase/fast-forward merge where the base tip (event SHA)
-        // equals the PR head SHA. The default self-checkout must still succeed.
-        github.context.sha = '1234567890123456789012345678901234567890'
-        const settings: IGitSourceSettings = await inputHelper.getInputs()
-        expect(settings.commit).toBe('1234567890123456789012345678901234567890')
-      } finally {
-        github.context.eventName = originalEvent
-        github.context.payload = originalPayload
-        github.context.sha = originalSha
-      }
-    })
-
-    it('refuses an explicit fork repository on pull_request_target', async () => {
-      const originalEvent = github.context.eventName
-      const originalPayload = github.context.payload
-      try {
-        github.context.eventName = 'pull_request_target'
-        github.context.payload = forkPayload as any
-        inputs.repository = 'attacker/fork'
-        await expect(inputHelper.getInputs()).rejects.toThrow(
-          /Refusing to check out fork pull request code/
-        )
-      } finally {
-        github.context.eventName = originalEvent
-        github.context.payload = originalPayload
-      }
-    })
-  })
 })

__test__/unsafe-pr-checkout-helper.test.ts

@@ -13,7 +13,6 @@ const PR_MERGE_SHA = '2222222222222222222222222222222222222222'
 const SAFE_BASE_SHA = '3333333333333333333333333333333333333333'
 const WORKFLOW_RUN_HEAD_COMMIT_SHA = '4444444444444444444444444444444444444444'
 const BASE_QUALIFIED_REPO = 'some-owner/some-repo'
-const FORK_QUALIFIED_REPO = 'another-repo/fork'
 
 function setContext(eventName: string, payload: object): void {
   ;(github.context as {eventName: string}).eventName = eventName
@@ -26,7 +25,7 @@ function forkPullRequestTargetPayload(): object {
     pull_request: {
       head: {
         sha: PR_HEAD_SHA,
-        repo: {id: FORK_REPO_ID, full_name: FORK_QUALIFIED_REPO}
+        repo: {id: FORK_REPO_ID}
       },
       merge_commit_sha: PR_MERGE_SHA
     }
@@ -39,7 +38,7 @@ function sameRepoPullRequestTargetPayload(): object {
     pull_request: {
       head: {
         sha: PR_HEAD_SHA,
-        repo: {id: BASE_REPO_ID, full_name: BASE_QUALIFIED_REPO}
+        repo: {id: BASE_REPO_ID}
       },
       merge_commit_sha: PR_MERGE_SHA
     }
@@ -52,7 +51,7 @@ function forkWorkflowRunPayload(): object {
     workflow_run: {
       event: 'pull_request',
       head_commit: {id: WORKFLOW_RUN_HEAD_COMMIT_SHA},
-      head_repository: {id: FORK_REPO_ID, full_name: FORK_QUALIFIED_REPO}
+      head_repository: {id: FORK_REPO_ID}
     }
   }
 }
@@ -165,7 +164,7 @@ describe('unsafe-pr-checkout-helper', () => {
     setContext('pull_request_target', forkPullRequestTargetPayload())
     expect(() =>
       assertSafePrCheckout({
-        qualifiedRepository: FORK_QUALIFIED_REPO,
+        qualifiedRepository: 'attacker/fork',
         ref: 'refs/heads/main',
         commit: '',
         allowUnsafePrCheckout: false
@@ -173,25 +172,13 @@ describe('unsafe-pr-checkout-helper', () => {
     ).toThrow()
   })
 
-  it('allows pull_request_target checkout of an unrelated third-party repo', () => {
-    setContext('pull_request_target', forkPullRequestTargetPayload())
-    expect(() =>
-      assertSafePrCheckout({
-        qualifiedRepository: 'some-other/unrelated',
-        ref: 'refs/heads/main',
-        commit: '',
-        allowUnsafePrCheckout: false
-      })
-    ).not.toThrow()
-  })
-
   it('refuses pull_request_target ignoring repository case differences', () => {
     setContext('pull_request_target', forkPullRequestTargetPayload())
     expect(() =>
       assertSafePrCheckout({
-        qualifiedRepository: FORK_QUALIFIED_REPO.toUpperCase(),
+        qualifiedRepository: 'SOME-OWNER/SOME-REPO',
         ref: '',
-        commit: '',
+        commit: PR_HEAD_SHA,
         allowUnsafePrCheckout: false
       })
     ).toThrow()

action.yml

@@ -101,11 +101,8 @@ inputs:
   allow-unsafe-pr-checkout:
     description: >
       Required to check out fork pull request code from a workflow triggered by
-      `pull_request_target` or `workflow_run`. These workflows run with the
-      base repository's GITHUB_TOKEN, secrets, default-branch cache scope, and
-      runner access; fetching and executing a fork's code in that trusted
-      context commonly leads to "pwn request" vulnerabilities. Set to `true`
-      only after reviewing the risks at https://gh.io/securely-using-pull_request_target.
+      `pull_request_target` or `workflow_run`. See [Pwn Requests](todo:need-link)
+      for the risks. Set to `true` only after reviewing the risks.
     default: false
 outputs:
   ref:

dist/index.js

@@ -2059,23 +2059,6 @@ function getInputs() {
             `${github.context.repo.owner}/${github.context.repo.repo}`.toUpperCase();
         // Source branch, source version
         result.ref = core.getInput('ref');
-        // core.getInput()'s default trim strips a range of Unicode characters such as a
-        // leading BOM (U+FEFF) or NBSP (U+00A0). Those are valid in a git ref name, so
-        // a fork branch named "<BOM>" + 40 hex chars would trim down to a bare SHA and
-        // be silently reclassified as a commit, bypassing the unsafe fork PR checkout
-        // guard.
-        //
-        // The trim below strips only the ASCII whitespace characters which are all forbidden
-        // in a git branch name.
-        //   \t  U+0009  horizontal tab   - ASCII control, forbidden in ref names
-        //   \n  U+000A  line feed        - ASCII control, forbidden in ref names
-        //   \v  U+000B  vertical tab     - ASCII control, forbidden in ref names
-        //   \f  U+000C  form feed        - ASCII control, forbidden in ref names
-        //   \r  U+000D  carriage return  - ASCII control, forbidden in ref names
-        //   ' ' U+0020  space            - forbidden in ref names
-        const asciiTrimmedRef = core
-            .getInput('ref', { trimWhitespace: false })
-            .replace(/^[\t\n\v\f\r ]+|[\t\n\v\f\r ]+$/g, '');
         if (!result.ref) {
             if (isWorkflowRepository) {
                 result.ref = github.context.ref;
@@ -2088,8 +2071,8 @@ function getInputs() {
             }
         }
         // SHA?
-        else if (asciiTrimmedRef.match(/^(?:[0-9a-fA-F]{40}|[0-9a-fA-F]{64})$/)) {
-            result.commit = asciiTrimmedRef;
+        else if (result.ref.match(/^(?:[0-9a-fA-F]{40}|[0-9a-fA-F]{64})$/)) {
+            result.commit = result.ref;
             result.ref = '';
         }
         core.debug(`ref = '${result.ref}'`);
@@ -2167,19 +2150,12 @@ function getInputs() {
             (core.getInput('allow-unsafe-pr-checkout') || 'false').toUpperCase() ===
                 'TRUE';
         core.debug(`allow unsafe PR checkout = ${result.allowUnsafePrCheckout}`);
-        // The default self-checkout (this repository with no explicit ref) always
-        // resolves to the trusted ref/commit GitHub set for the triggering event, so
-        // the fork-checkout guard only needs to run when the caller customized the
-        // repository or ref.
-        const isDefaultCheckout = isWorkflowRepository && !core.getInput('ref');
-        if (!isDefaultCheckout) {
-            unsafePrCheckoutHelper.assertSafePrCheckout({
-                qualifiedRepository,
-                ref: result.ref,
-                commit: result.commit,
-                allowUnsafePrCheckout: result.allowUnsafePrCheckout
-            });
-        }
+        unsafePrCheckoutHelper.assertSafePrCheckout({
+            qualifiedRepository,
+            ref: result.ref,
+            commit: result.commit,
+            allowUnsafePrCheckout: result.allowUnsafePrCheckout
+        });
         return result;
     });
 }
@@ -2817,11 +2793,9 @@ function assertSafePrCheckout(input) {
         return;
     }
     let prHeadRepoId;
-    let prHeadRepoFullName;
     const prShas = [];
     if (eventName === 'pull_request_target') {
         prHeadRepoId = (0, ref_helper_1.fromPayload)('pull_request.head.repo.id');
-        prHeadRepoFullName = (0, ref_helper_1.fromPayload)('pull_request.head.repo.full_name');
         pushIfSha(prShas, (0, ref_helper_1.fromPayload)('pull_request.head.sha'));
         pushIfSha(prShas, (0, ref_helper_1.fromPayload)('pull_request.merge_commit_sha'));
     }
@@ -2831,13 +2805,7 @@ function assertSafePrCheckout(input) {
             return;
         }
         prHeadRepoId = (0, ref_helper_1.fromPayload)('workflow_run.head_repository.id');
-        prHeadRepoFullName = (0, ref_helper_1.fromPayload)('workflow_run.head_repository.full_name');
         pushIfSha(prShas, (0, ref_helper_1.fromPayload)('workflow_run.head_commit.id'));
-        // For `pull_request_target`-triggered workflow_run, `head_sha` is the base
-        // default branch SHA (not the PR head)
-        if (wrEvent !== 'pull_request_target') {
-            pushIfSha(prShas, (0, ref_helper_1.fromPayload)('workflow_run.head_sha'));
-        }
     }
     // (A) Fork PR?
     if (typeof prHeadRepoId !== 'number' || prHeadRepoId === baseRepoId) {
@@ -2845,21 +2813,21 @@ function assertSafePrCheckout(input) {
     }
     // (B) We cannot check for all fork PR refs so check to see
     // if the resolved input points to the fork PR sha we have in the payload
-    const repositoryMatchesPrHead = typeof prHeadRepoFullName === 'string' &&
-        input.qualifiedRepository.toLowerCase() === prHeadRepoFullName.toLowerCase();
+    const baseQualifiedRepository = `${github.context.repo.owner}/${github.context.repo.repo}`;
+    const repositoryDiffersFromBase = input.qualifiedRepository.toLowerCase() !==
+        baseQualifiedRepository.toLowerCase();
     const refMatchesPullPattern = PR_REF_PATTERN.test(input.ref);
     const commitMatchesPrHeadSha = !!input.commit && prShas.includes(input.commit.toLowerCase());
-    if (!repositoryMatchesPrHead &&
+    if (!repositoryDiffersFromBase &&
         !refMatchesPullPattern &&
         !commitMatchesPrHeadSha) {
         return;
     }
     throw new Error(`Refusing to check out fork pull request code from a '${eventName}' workflow. ` +
         `This workflow runs with the base repository's GITHUB_TOKEN, secrets, default-branch ` +
-        `cache scope, and runner access. Fetching and executing a fork's code in that trusted ` +
-        `context commonly leads to "pwn request" vulnerabilities. To opt in, review the risks ` +
-        `at https://gh.io/securely-using-pull_request_target and set 'allow-unsafe-pr-checkout: true' ` +
-        `on the actions/checkout step.`);
+        `cache scope, and runner access. Fetching fork's code in that trusted context is a ` +
+        `"pwn request" supply-chain attack pattern. To opt in after reviewing the risk, set ` +
+        `'allow-unsafe-pr-checkout: true' on the actions/checkout step.`);
 }
 function pushIfSha(target, value) {
     if (typeof value === 'string' && value.length > 0) {

src/input-helper.ts

@@ -59,23 +59,6 @@ export async function getInputs(): Promise<IGitSourceSettings> {
 
   // Source branch, source version
   result.ref = core.getInput('ref')
-  // core.getInput()'s default trim strips a range of Unicode characters such as a
-  // leading BOM (U+FEFF) or NBSP (U+00A0). Those are valid in a git ref name, so
-  // a fork branch named "<BOM>" + 40 hex chars would trim down to a bare SHA and
-  // be silently reclassified as a commit, bypassing the unsafe fork PR checkout
-  // guard.
-  //
-  // The trim below strips only the ASCII whitespace characters which are all forbidden
-  // in a git branch name.
-  //   \t  U+0009  horizontal tab   - ASCII control, forbidden in ref names
-  //   \n  U+000A  line feed        - ASCII control, forbidden in ref names
-  //   \v  U+000B  vertical tab     - ASCII control, forbidden in ref names
-  //   \f  U+000C  form feed        - ASCII control, forbidden in ref names
-  //   \r  U+000D  carriage return  - ASCII control, forbidden in ref names
-  //   ' ' U+0020  space            - forbidden in ref names
-  const asciiTrimmedRef = core
-    .getInput('ref', {trimWhitespace: false})
-    .replace(/^[\t\n\v\f\r ]+|[\t\n\v\f\r ]+$/g, '')
   if (!result.ref) {
     if (isWorkflowRepository) {
       result.ref = github.context.ref
@@ -89,8 +72,8 @@ export async function getInputs(): Promise<IGitSourceSettings> {
     }
   }
   // SHA?
-  else if (asciiTrimmedRef.match(/^(?:[0-9a-fA-F]{40}|[0-9a-fA-F]{64})$/)) {
-    result.commit = asciiTrimmedRef
+  else if (result.ref.match(/^(?:[0-9a-fA-F]{40}|[0-9a-fA-F]{64})$/)) {
+    result.commit = result.ref
     result.ref = ''
   }
   core.debug(`ref = '${result.ref}'`)
@@ -185,19 +168,12 @@ export async function getInputs(): Promise<IGitSourceSettings> {
     'TRUE'
   core.debug(`allow unsafe PR checkout = ${result.allowUnsafePrCheckout}`)
 
-  // The default self-checkout (this repository with no explicit ref) always
-  // resolves to the trusted ref/commit GitHub set for the triggering event, so
-  // the fork-checkout guard only needs to run when the caller customized the
-  // repository or ref.
-  const isDefaultCheckout = isWorkflowRepository && !core.getInput('ref')
-  if (!isDefaultCheckout) {
-    unsafePrCheckoutHelper.assertSafePrCheckout({
-      qualifiedRepository,
-      ref: result.ref,
-      commit: result.commit,
-      allowUnsafePrCheckout: result.allowUnsafePrCheckout
-    })
-  }
+  unsafePrCheckoutHelper.assertSafePrCheckout({
+    qualifiedRepository,
+    ref: result.ref,
+    commit: result.commit,
+    allowUnsafePrCheckout: result.allowUnsafePrCheckout
+  })
 
   return result
 }

src/unsafe-pr-checkout-helper.ts

@@ -6,7 +6,7 @@ const PR_REF_PATTERN = /^refs\/pull\/[0-9]+\/(?:head|merge)$/
 export interface IUnsafePrCheckoutInput {
   qualifiedRepository: string
   ref: string
-  commit: string | undefined
+  commit: string
   allowUnsafePrCheckout: boolean
 }
 
@@ -26,12 +26,10 @@ export function assertSafePrCheckout(input: IUnsafePrCheckoutInput): void {
   }
 
   let prHeadRepoId: unknown
-  let prHeadRepoFullName: unknown
   const prShas: string[] = []
 
   if (eventName === 'pull_request_target') {
     prHeadRepoId = fromPayload('pull_request.head.repo.id')
-    prHeadRepoFullName = fromPayload('pull_request.head.repo.full_name')
     pushIfSha(prShas, fromPayload('pull_request.head.sha'))
     pushIfSha(prShas, fromPayload('pull_request.merge_commit_sha'))
   } else {
@@ -40,13 +38,7 @@ export function assertSafePrCheckout(input: IUnsafePrCheckoutInput): void {
       return
     }
     prHeadRepoId = fromPayload('workflow_run.head_repository.id')
-    prHeadRepoFullName = fromPayload('workflow_run.head_repository.full_name')
     pushIfSha(prShas, fromPayload('workflow_run.head_commit.id'))
-    // For `pull_request_target`-triggered workflow_run, `head_sha` is the base
-    // default branch SHA (not the PR head)
-    if (wrEvent !== 'pull_request_target') {
-      pushIfSha(prShas, fromPayload('workflow_run.head_sha'))
-    }
   }
 
   // (A) Fork PR?
@@ -56,15 +48,16 @@ export function assertSafePrCheckout(input: IUnsafePrCheckoutInput): void {
 
   // (B) We cannot check for all fork PR refs so check to see
   // if the resolved input points to the fork PR sha we have in the payload
-  const repositoryMatchesPrHead =
-    typeof prHeadRepoFullName === 'string' &&
-    input.qualifiedRepository.toLowerCase() === prHeadRepoFullName.toLowerCase()
+  const baseQualifiedRepository = `${github.context.repo.owner}/${github.context.repo.repo}`
+  const repositoryDiffersFromBase =
+    input.qualifiedRepository.toLowerCase() !==
+    baseQualifiedRepository.toLowerCase()
   const refMatchesPullPattern = PR_REF_PATTERN.test(input.ref)
   const commitMatchesPrHeadSha =
     !!input.commit && prShas.includes(input.commit.toLowerCase())
 
   if (
-    !repositoryMatchesPrHead &&
+    !repositoryDiffersFromBase &&
     !refMatchesPullPattern &&
     !commitMatchesPrHeadSha
   ) {
@@ -74,10 +67,9 @@ export function assertSafePrCheckout(input: IUnsafePrCheckoutInput): void {
   throw new Error(
     `Refusing to check out fork pull request code from a '${eventName}' workflow. ` +
       `This workflow runs with the base repository's GITHUB_TOKEN, secrets, default-branch ` +
-      `cache scope, and runner access. Fetching and executing a fork's code in that trusted ` +
-      `context commonly leads to "pwn request" vulnerabilities. To opt in, review the risks ` +
-      `at https://gh.io/securely-using-pull_request_target and set 'allow-unsafe-pr-checkout: true' ` +
-      `on the actions/checkout step.`
+      `cache scope, and runner access. Fetching fork's code in that trusted context is a ` +
+      `"pwn request" supply-chain attack pattern. To opt in after reviewing the risk, set ` +
+      `'allow-unsafe-pr-checkout: true' on the actions/checkout step.`
   )
 }