During the course of reviewing @aaronr's last PR, #48, some issues regarding the new continuous deployment method were exposed.
Backstory:
PR #44 added tooling to run the .travis/deploy-to-gh-pages.sh
build script that analyzes if the build is taking place on the master
branch and will merge master
into the gh-pages
branch. To allow Travis to make the merge, it was given a Github OAuth token (stored privately on Travis) with public_repo
scope. The logic to determine which branch the build was occurring on was a bit incorrect, causing every build (including PRs) to be deployed to gh-pages
. (This was discussed in greater detail in the comments of PR #48, and was fixed with PR #49)
Issue:
What was exposed during that process was that Travis will run whatever code it's given during a PR build. This allows for anyone to make a PR with malicious intent that will be executed with our Github credentials. For example, someone could make a PR to alter .travis/deploy-to-gh-pages.sh
so that it erases all the files within the repo, rebases the repo, and then does a forced push to Github, effectively erasing all history. Furthermore, that same auth token could be used on any other public repo that the creator (myself) owns. Since Git is distributed, those changes could be reversed, but it's not a situation we want to get ourselves in.
![efasbxh](https://cloud.githubusercontent.com/assets/897290/7216710/2258ae4a-e5c5-11e4-8d83-f8bdf06fdaea.gif)
Suggestions:
@aaronr and I agreed that, for a short term fix, we should disable builds on PRs. This was done that night, immediately after the vulnerability was realized. This means that currently, we must run tests on PRs locally, which isn't ideal.
It doesn't seem like there's any safe way to have the codebase dictate deployment steps if it involves granting every build with Github credentials. Travis doesn't seem to have the ability to manage deployment steps from the web-admin or to only grant Github access tokens to non-PR builds. Travis works really well for notifying us of PR's test results, so I think we should keep with using it for that. I think we're going to have to look elsewhere for the automated deployment step.
Does anyone know of free, hosted tools that will subscribe to a Git repo and can run arbitrary node/bash scripts? I'm going to start going through the links on this list and see which fit.