Ci gaba da Haɗawa da Ci gaba da Aiki (CI/CD) pipelines suna taka muhimmiyar rawa wajen sauƙaƙe haɓaka software. Duk da haka, kamar yadda waɗannan pipelineIdan aka ƙara samun mahimmanci, to wajibi ne a kare su daga rauni ya zama mafi girma. Wannan bincike mai zurfi ya mayar da hankali kan magance wata babbar haɗari da aka gano a cikin Top-10 na OWASP CI/CD Haɗarin Tsaro: Guba Pipeline Aiwatarwa (PPE).
Menene Guba Pipeline Aiwatarwa (PPE)
A cewar OWASP Top-10 CI/CD Hadarin Tsaro, "Guba Pipeline kisa (PPE) haɗari yana nufin ikon mai hari tare da damar shiga tsarin sarrafa tushe - kuma ba tare da samun damar shiga yanayin ginin ba - don sarrafa tsarin ginawa ta hanyar saka mummunan code/umarni a cikin ginin pipeline sanyi, da gaske 'guba' pipeline da kuma gudanar da lambar mugunta a matsayin wani ɓangare na tsarin ginawa"
A cikin 'yan kalmomi kaɗan, An guba Pipeline Ana aiwatar da aiwatarwa (PPE) lokacin da maharin zai iya canza yanayin pipeline dabaru.
Akwai biyu bambance-bambancen karatu:
- PPE kai tsaye (D-PPE): A cikin yanayin D-PPE, maharin yana canza fayil ɗin saitin CI a cikin ma'ajiyar ajiya suna da damar shiga, ko dai ta hanyar tura canjin kai tsaye zuwa wani reshe mai nisa wanda ba shi da kariya a kan ma'ajiyar, ko kuma ta hanyar aika PR tare da canjin daga reshe ko cokali mai yatsu. Tun daga CI pipeline Ana bayyana aiwatarwa ta hanyar umarni a cikin fayil ɗin CI da aka gyara, umarnin mugunta na maharin a ƙarshe suna gudana a cikin ma'aunin gini da zarar ginin ya fara. pipeline an kunna shi.
- PPE na kai tsaye (I-PPE): A wasu lokuta, yiwuwar D-PPE ba ta samuwa ga abokin gaba mai damar shiga SCM ma'ajiyar bayanai (misali idan pipeline an tsara shi don cire fayil ɗin daidaitawar CI daga wani reshe daban, mai kariya a cikin ma'ajiyar iri ɗaya). A irin wannan yanayi, maimakon guba pipeline da kansa, wani mahari yana saka lambar mugunta a cikin fayilolin da aka ambata pipeline (misali: rubutun da aka ambata daga cikin pipeline fayil ɗin sanyi)
A dukkan bangarorin, GitHub zai aiwatar da gyare-gyaren da aka gyara pipeline ba tare da buƙatar sake dubawa ko amincewa a baya ba.
Gano PPE da wuri
Ta yaya za mu iya gano irin wannan rauni?
Bari mu ga wannan misali pipeline :
name: PR CI
on:
pull_request:
branches: [ main ]
env:
MY_SECRET: ${{ secrets.MY_SECRET }}
jobs:
pr_build_test_and_merge:
runs-on: ubuntu-latest
steps:
# checkout PR code
- name: Checkout repository
uses: actions/checkout@v4
# Simulation of a compilation
- name: Building ...
run: |
echo $MY_SECRET
mkdir ./bin
touch ./bin/mybin.exe
# Simulation of running tests
- name: Running tests ...
id : run_tests
run: |
echo Running tests..
chmod +x runtests.sh
./runtests.sh "${{ github.event.pull_request.user.login }}" "${{ github.workflow }}"
echo Tests executed.
Kuma abubuwan da ke cikin rubutun harsashi na banza (runtests.sh):
#!/usr/bin/bash
echo "Executing Tests script [from user $1 at $2]" >> runtests.out
exit 0
The pipeline abu ne mai sauƙi: manufarsa ita ce samar wa mai bita wasu shawarwari na farko don Pull Request Tsarin karɓar (PR):
- Za a fara shi a buƙatar_pull_request (watau duk lokacin da aka ƙirƙiri PR)
- Yana duba lambar PR (watau lambar da aka bayar)
- Zai yi aikin ginin
- Zai gudanar da gwaje-gwaje akan lambar da aka bayar (misali ta hanyar aiwatar da rubutun harsashi)
Matakai na 3 (yin ginin) da #4 (gwajin gudu) za su gaza idan lambar ba ta tattara ba ko kuma ta kasa cin jarrabawar. Don haka, waɗannan matakan suna aiki a matsayin sharaɗin da ake buƙata, amma ba su isa ba, don karɓar PR. Idan sun yi nasara, mai kula da repo zai ci gaba da duba lambar da aka bayar kuma, bisa ga haka, zai/za ta ...
Na'urar Duba Xygeni
Xygeni yana ba da CLI ("da"Na'urar Duba Xygeni") wanda za a iya saka shi a cikin wani pipeline ko kuma a yi amfani da layin umarni. Na'urar daukar hoton Xygeni za ta sarrafa shi pipelines don duba raunin da ke tattare da shi, kuma idan an samar da GitHub PAT, zai haɗu da GitHub don gano raunin da ke tattare da shi a matakin org/repo.
Kayayyakin Xygeni
Lokacin da muka aiwatar da na'urar daukar hoton Xygeni akan wannan wurin ajiyar, yana gano wani tsari mai amfani na kadarori (wanda Kayayyakin Xygeni). Kayayyakin za su cika da nau'ikan kayayyaki daban-daban. CI/CD dukiya, kamar:
- The SCM System inda aka adana ma'ajiyar
- The SCM plugins an shigar/an yi amfani da shi
- The Ma'ajiyar Lambobi kanta
- The SCM Kungiyar inda wurin ajiyar yake
- The CI/CD Pipelines da Ayyuka
- The CI/CD System gudu da pipelines
- IaC Aikace-Aikace an bayyana shi a cikin wurin ajiye kaya
- external Dalilai
- da dai sauransu ..
A cikin misalinmu, za mu iya tace Inventory ta wani takamaiman nau'in kadara (SCM- da kadarorin da suka shafi CICD), don haka za mu iya ganin cewa:
- SCM tsarin shine GitHub Cloud
- Ana adana Repo a cikin GitHub Cloud kuma yana cikin takamaiman ƙungiyar GitHub
- Akwai biyu pipelines yana aiki ta GitHub (CI/CD tsarin)
- Kowane pipeline ya ƙunshi takamaiman mataki ɗaya
Ta hanyar zaɓar abin da ke sama pipeline za mu iya ganin wasu raunin:
- At pipeline matakin, yana da rauni ga duka biyun Direct da kuma PPE mara kai tsaye.
Za mu iya ganin cikakkun bayanai game da waɗanda suka kamu da cutar Pipeline Rashin raunin aiwatarwa
Xygeni yana gano cewa mai rauni ga D-PPE saboda an yi shi ne a kan wani Pull Request kuma babu ƙarin iko na tsaro, don haka kowane mai amfani da repo zai iya gyara lamarin pipeline kuma za a aiwatar da waɗannan gyare-gyare ba tare da wani bita ko amincewa ba.
A irin wannan ma'anar, Xygeni kuma yana gano cewa mai rauni ga I-PPE saboda kiran rubutun harsashi daga pipeline: duk wani mai amfani da repo zai iya gyara rubutun harsashi kuma waɗannan gyare-gyaren za a aiwatar ba tare da wani bita ko amincewa ba.
Kuna son ƙarin sani?
Amfani da PPE
Don amfani da kayan kariya na sirri (PPE) bari mu yi la'akari da yanayin da akwai nau'ikan masu amfani da repo guda biyu:
- An mai amfani na ciki (wani mai haɓaka cikin gida yana aiki akan wannan wurin ajiyar), tare da izinin rubutawa akan wurin ajiyar
- An mai amfani na waje (mai haɓaka kayan aiki na waje wanda ke aiki akan wannan wurin ajiya amma tare da izinin karantawa akan wurin ajiya), watau ba a ba shi izinin reshe na wurin ajiya ba kuma an tilasta masa yin aiki akan cokali mai yatsu.
Bari mu yi tunanin cewa duka biyun masu kai hari ne masu cutarwa (ko kuma waɗanda wani mugun mutum ya yi musu ƙwallo). Ma'ajiyar ta ƙunshi wasu sirri kuma duka suna so. don satar sirrin ajiya kuma a aika shi zuwa sabar da masu kutse ke sarrafa ta. Domin yin hakan, za su yi amfani da Poisoned Pipeline Rashin raunin aiwatarwa na pipeline.
A duka yanayi biyu (mai amfani na waje da na ciki), suna buɗewa Pull Request tare da irin waɗannan gyare-gyare:
- The pipeline kuma an gyara rubutun harsashi to karanta sirrin daga muhalli da kuma aika shi zuwa sabar da masu kutse ke sarrafa ta
Canje-canje na iya zama kamar haka:
Duk masu amfani za su ƙirƙiri wani shafi Pull Request tare da canje-canjeBayan ƙirƙirar hulɗar jama'a, GitHub zai aiwatar da gyare-gyaren biyu (ba tare da buƙatar sake dubawa ko amincewa a baya ba), wanda ya haifar da haka:
Haka kuma ga masu amfani da rubutu da karatu, A duka lokuta biyu, ana aiwatar da D-PPE da I-PPE, tare da bambancin da ke Mai amfani da aka karanta ba zai iya samun damar shiga sirrin ba. (!!!!)
Wannan dalili ne saboda, idan aka samu wata matsala ta hanyar sadarwa daga cokali mai yatsu, GitHub ba ya ba da damar shiga cikin sirrin wurin ajiyar bayanai. Duk da cewa mai amfani da ke karantawa ba zai iya karanta sirrin ba, har yanzu yana iya gudanar da kowace irin shiri. Misalin harin da aka saba gani shine ƙirƙirar PRs waɗanda ke saukar da mai hakar ma'adinai na crypto, don haka mai gudu na GitHub zai kashe mai hakar ma'adinai na crypto lokacin da yake aiwatar da guba pipeline.
Wannan ba muhallin aminci bane, ba shakka!! Me mai kula da repo zai iya yi don guje masa?
Bayan ɗan bincike a shafin yanar gizo, mai kula da repo ya yanke shawarar gyara pipeline za a fara aiki a kan wani pull_request_target taron. Me yasa? Domin pipelines da aka kunna akan pull_request_target baya bada izinin aiwatarwa pipeline gyare-gyare, watau duk da duk wani gyara da mai amfani ya yi wa "asali" pipeline za a kashe shi.
Bisa ga misalinmu, harin zai kasance iri ɗaya da na baya. Me zai faru bayan haka? pipeline gyara?
Kamar yadda aka sa ran, Ba a aiwatar da D-PPE ba amma, saboda I-PPE har yanzu yana nan, mai amfani da aka karanta yanzu yana iya samun damar sirrin wurin ajiya!!!
Mene ne dalilin da yasa mai karatu yanzu yake da damar samun sirri? pipeline ba za a iya gyara shi ba, har yanzu yana yiwuwa a gyara rubutun harsashi. Lokacin da pipeline An kunna shi akan pull_request_target, za a aiwatar da shi a yanayin gata na musamman so zai kuma zama rubutun harsashi, wanda ke haifar da rubutun harsashi yana da damar shiga sirrin repo!!
m Matakan
GitHub yana ba da wasu matakai don kariya daga munanan hulɗar jama'a.
Dokokin kariyar reshe
Tare da GitHub zaka iya ayyana Dokokin Kariyar Reshe akan zaɓaɓɓun rassan.
Ga rassanka masu kariya, za ka iya ƙayyade manufar da za ta na bukatar a pull request kafin haɗawa (da kuma ƙarin sharuɗɗa kamar adadin amincewa da ake buƙata, sake dubawa daga masu lambar, da sauransu)
Wasu sharuɗɗa guda biyu da suka cancanci a yi la'akari da su musamman sune:
- "Bada izinin takamaiman 'yan wasan kwaikwayo su ketare abin da ake buƙata pull requests".
- "Kada a bari a wuce saitunan da ke sama"
Duk da cewa yawancin sharuɗɗan suna ƙara tsauri ga manufar, waɗannan suna sassauta manufar kuma hakan na iya haifar da buɗe ƙofa ga ayyukan mugunta, misali, idan masu "gata" suka sace takardun shaidar.
Taƙaita izinin GITHUB_TOKEN (mafi ƙarancin gata)
Takaita izinin alamun GitHub kawai ga waɗanda ake buƙata; ta wannan hanyar, koda kuwa maharan sun yi nasarar yin ɓarna ga asusunka pipeline, ba za su iya yin abubuwa da yawa ba.
Guji haɗa igiya ta amfani da pipeline masu canjin env
Duk lokacin da ka yi amfani da wasu canje-canje a cikin saitunan wayarka pipeline, a sani cewa ya kamata a ɗauke su a matsayin bayanai marasa aminci (mai amfani ne ke sarrafa abubuwan da ke cikinsu). Duba Ayyuka marasa aminci da tsarin aiki amintacce da kuma Koyi Ayyukan Github.
Ya kamata koyaushe ka yi amfani da masu canjin yanayi don saka masu canjin shigarwa a cikin rubutun maimakon amfani da haɗin igiya.
Gudanar da aikin aiki da buƙatun amincewa
Ma jama'a wurin ajiya, GitHub yana ba da damar ƙayyadewa yadda ake aiki tare da "PRs" na waje.
Saitunan Tsarin GitHub (“Org >> Saituna >> Ayyuka >> Gabaɗaya”) bari a fayyace yadda ake sarrafa PR na waje:
Ta hanyar tsoho, GitHub zai buƙaci amincewar PR ga masu ba da gudummawa na farko, wanda hakan ke sa hare-haren neman laifi su zama masu rikitarwa. Duk da haka, maharin na iya samun amincewar masu kula da aikin misali ta hanyar ba da gudummawar wasu marasa laifi. pull request kafin ainihin harin.
A wannan yanayin, da Zabi na 3 (Yana buƙatar amincewa ga duk masu haɗin gwiwa na waje) yana ƙara matakin iko mafi girma.
Ma masu zaman kansu a wurin, GitHub yana ba da iko mai taimako duka a matakin Ƙungiya da kuma matakin Repo.
"Gudanar da Tsarin Aiki daga Pull Requests"(ba a duba ta hanyar tsoho ba) yana bawa masu amfani damar gudanar da ayyukan aiki daga fork PRs (ta amfani da GITHUB_TOKEN tare da izinin karantawa kawai kuma ba tare da samun damar shiga sirri ba). Ta hanyar zaɓar wannan zaɓi tare da na ƙarshe ("Ana buƙatar amincewa don ayyukan aikin fork PRs"), zaku iya cimma manufa iri ɗaya da ma'ajiyar sirri (kamar yadda aka nuna a sama).
Kamar yadda muka gani a cikin amfani da PPE daga mai karatu, damar gudanar da aikin daga fork pull requests ba shi da aminci!!
Sauran zaɓuɓɓukan (“)Aika alamun rubutu zuwa hanyoyin aiki daga fork pull requests"Da kuma"Aika sirri da masu canji zuwa hanyoyin aiki daga pull requests") rage matakin tsaro an yi amfani da shi a kan fork PRs.
Za ka iya ayyana wannan manufar fork ko dai a Matakin Ƙungiya ko kuma a Matakin Repo. Idan manufar ta kashe a matakin org, ba za a iya kunna ta a matakin repo ba. Amma, idan manufar ta kunna a matakin org, za a iya kashe ta a matakin repo.
sake bayyanawa
Muna fatan kun ga ma'anar samun wasu pipeline mai rauni ga Guba Pipeline Aiwatarwa. Yana da sauƙi sosai commit mai rauni pipeline, kuma yana da wuya a rubuta wanda aka amince da shi.
Don haka yana da matuƙar muhimmanci a yi amfani da na'urar daukar hoton Xygeni don sanin irin waɗannan raunin.
Ba za ka iya magance matsalar ƙazanta ba sai ka san akwai ta!!
Amma… Har yanzu akwai tambaya a gaba… Yaya za a guji I-PPE?
Wannan zai zama batun rubutunmu na gaba 🙂 … Guba kai tsaye Pipeline Aiwatarwa (I-PPE) !!
