Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Convert this action to a NodeJS action to improve security #3

Open
2 tasks
christian-kreuzberger-dtx opened this issue Apr 23, 2021 · 0 comments
Open
2 tasks
Labels
enhancement New feature or request hardening

Comments

@christian-kreuzberger-dtx

Right now this action provides an attack vector that could leak API Credentials to the Dynatrace API.
Unfortunately, this is by design of GH Actions when you use composite actions with Bash Scripts.

The only way to work around this would be to rewrite parts of this action in NodeJS, and access the secrets from input rather than from an environment variable, same as we do in gh-action-send-event:
https://github.com/keptn/gh-action-send-event/blob/main/index.js#L5-L7

We can still download can execute install.sh from the dynatrace-operator. We just need to make sure (e.g., by calling env within that script) that no environment variables with the Token or the API URl are available.

Definition of Done

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
enhancement New feature or request hardening
Projects
None yet
Development

No branches or pull requests

1 participant