Add explicit permissions to GitHub workflows#2723
Conversation
| { | ||
| final File outputFile = new File(outputDir, entry.getName()); | ||
|
|
||
| if (!outputFile.toPath().normalize().startsWith(outputDir.toPath())) |
There was a problem hiding this comment.
This should prevent the zip slip concern, but probably best to stash outputDir.toPath().normalize() outside the loop and use that.
|
@labkey-tchad what steps in the merge/release process will end up testing the workflow permissions? |
The next time we merge changes forward from 25.10 should verify them both. |
@labkey-klum heads up on this change. Hopefully it won't have any impact on the merge process, but if you see problems with testAutomation, let us know |
2 participants
Rationale
Cleaning up several security warnings.
We should validate that the workflow permission changes work correctly before we roll out to other repositories.
Related Pull Requests
Changes
TestFileUtils