Ukuhlanganiswa Okuqhubekayo kunye Nokusasazwa Okuqhubekayo (CI/CD) pipelinezidlala indima ebalulekileyo ekuququzeleleni uphuhliso lwesoftware olucwangcisiweyo. Sekunjalo, njengoko ezi pipelineUkuba ziya zisiba zibaluleke ngakumbi, ukubaluleka kokubakhusela kwiingxaki zabo kuya kucaca ngakumbi. Olu phando lunzulu lugxile ekujongeni umngcipheko obonakalayo ochongiweyo kwi-OWASP Top-10 CI/CD Iingozi zoKhuseleko: Zityhefwe Pipeline Ukuphunyezwa (PPE).
Yintoni etyheliweyo Pipeline Ukuphunyezwa (i-PPE)
Ngokwe-OWASP Top-10 CI/CD Iingozi zoKhuseleko, “Ityhefu Pipeline enze (PPE) umngcipheko ubhekisa kubuchule bomhlaseli bokufikelela kwiinkqubo zolawulo lomthombo - kwaye ngaphandle kokufikelela kwindawo yokwakha - ukulawula inkqubo yokwakha ngokufaka ikhowudi/imiyalelo enobungozi kwisakhiwo pipeline ukucwangciswa, ngokukodwa 'ukutyhefa' pipeline kunye nokusebenzisa ikhowudi enobungozi njengenxalenye yenkqubo yokwakha”
Ngamazwi ambalwa, iPoisoned Pipeline Ukuphunyezwa (i-PPE) kwenziwa xa umhlaseli angayitshintsha pipeline ingqiqo.
Kukho ezimbini hlu kileyo:
- I-PPE ethe ngqo (I-D-PPE): Kwimeko ye-D-PPE, umhlaseli uguqula ifayile yoqwalaselo lwe-CI kwindawo yokugcina izinto abanokufikelela kuyo, nokuba ngokutyhala utshintsho ngqo kwisebe elikude elingakhuselekanga kwi-repo, okanye ngokungenisa i-PR enotshintsho oluvela kwisebe okanye kwifoloko. Ukususela kwi-CI pipeline ukuphunyezwa kuchazwa yimiyalelo ekwifayile yoqwalaselo lwe-CI eguquliweyo, imiyalelo enobungozi yomhlaseli ekugqibeleni isebenza kwindawo yokwakha xa sele iqalile ukwakha. pipeline ibangelwe.
- I-PPE engathanga ngqo (I-PPE): Kwiimeko ezithile, ithuba le-D-PPE alifumaneki kutshaba olunokufikelela kwi- SCM indawo yokugcina impahla (umz. ukuba pipeline yenzelwe ukutsala ifayile yoqwalaselo lwe-CI kwisebe elahlukileyo, elikhuselweyo kwindawo efanayo yokugcina izinto). Kwimeko enjalo, endaweni yokutyhefa pipeline ngokwayo, umhlaseli ufaka ikhowudi enobungozi kwiifayile ezibhekiselwe kwi pipeline (umzekelo: izikripthi ezibhekiselwe ngaphakathi pipeline ifayile yoqwalaselo)
Kuzo zombini ezi meko, I-GitHub iza kuphumeza okuguquliweyo pipeline kungekho mfuneko yophononongo okanye imvume yangaphambili.
Ukufunyanwa kwangoko kwe-PPE
Sinokuyibona njani le meko yokuba sesichengeni?
Masibone lo mzekelo pipeline :
Kwaye umxholo weskripthi se-dummy shell (runtests.sh):
The pipeline ilula kakhulu: injongo yayo kukubonelela umvavanyi ngeengcebiso zokuqala malunga Pull Request Inkqubo yokwamkelwa (PR):
- Iza kuqaliswa ngomhla tsala_isicelo (oko kukuthi, nanini na xa kudalwa i-PR)
- Ijonga ikhowudi ye-PR (oko kukuthi ikhowudi enikelweyo)
- Iya kwenza ulwakhiwo
- Iya kuqhuba iimvavanyo kwikhowudi enikelweyo (umz. ngokwenza iskripthi segobolondo)
Amanyathelo #3 (yenza ulwakhiwo) kunye ne #4 (qhuba uvavanyo) aza kusilela ukuba ikhowudi ayihlanganisi okanye ayiphumeleli uvavanyo. Ngoko ke, la manyathelo asebenza njengemfuneko, kodwa awanelanga, imeko yokwamkela i-PR. Ukuba iphumelele, umphathi we-repo uza kuqhubeka nokujonga ikhowudi enikelweyo kwaye, ngokusekelwe kuloo nto, uza kwamkela/ale/aphawule i-PR.
Iskena seXygeni
I-Xygeni ibonelela nge-CLI ("Iskena seXygeni") ezinokufakwa kwi-" pipeline okanye isebenze kumgca womyalelo. I-Xygeni Scanner iya kuyicubungula pipelines ukujonga ubuthathaka kwaye, ukuba i-GitHub PAT ibonelelwe, iya kuqhagamshela kwi-GitHub ukuze kufunyanwe ubuthathaka kwinqanaba le-org/repo.
Uluhlu lweXygeni
Xa sisebenzisa i-Xygeni Scanner kule repo, sifumana iseti eluncedo yeeasethi (i Uluhlu lweXygeniUluhlu lwempahla luza kuzaliswa ngeentlobo ezahlukeneyo ze CI/CD asethi, njenge:
- The SCM isixokelelwano apho i-repo igcinwa khona
- The SCM plugins ifakiwe/isetyenzisiwe
- The Indawo yokugcina ikhowudi ngokwayo
- The SCM Umbutho apho i-repo ikwayo
- The CI/CD Pipelinekunye nemisebenzi
- The CI/CD isixokelelwano ukuqhuba i pipelines
- IaC Resources ichazwe kwi-repo
- Ngaphandle Ukuxhomekeka
- njl ..
Kumzekelo wethu, singahluza uluhlu lwezinto ngokweentlobo ezithile zeasethi (SCM- kunye neeasethi ezinxulumene neCICD), ukuze sikwazi ukubona ukuba:
- SCM inkqubo yiGitHub Cloud
- I-Repo igcinwa kwiGitHub Cloud kwaye iphantsi kwe-GitHub Organisation ethile
- Kukho ezimbini pipelineixhaswa yiGitHub (CI/CD inkqubo)
- wonke pipeline inenyathelo elinye elithile
Ngokukhetha oku kungasentla pipeline sinokubona ezinye iingxaki:
- At pipeline kwinqanaba, isengozini kuzo zombini Ngqo kwaye I-PPE engathanga ngqo.
Singazibona iinkcukacha zabo batyhefwe yityhefu Pipeline Ubuthathaka bokusebenza
IXygeni ifumanisa ukuba abasengozini kwi-D-PPE kuba iqaliswa kwi Pull Request kwaye akukho zilawuli zokhuseleko ezongezelelweyo, ngoko ke nawuphi na umsebenzisi we-repo unokutshintsha i- pipeline kwaye ezo nguqu ziya kwenziwa ngaphandle kophononongo okanye imvume.
Ngendlela efanayo, iXygeni ikwafumanisa ukuba abasengozini kwi-I-PPE ngenxa yokubizwa kwiskripthi segobolondo esivela kwi pipeline: nawuphi na umsebenzisi we-repo unokutshintsha iskripthi se-shell kwaye olo tshintsho luya kwenziwa ngaphandle kophononongo okanye imvume.
Ngaba uyafuna ukwazi ngakumbi?
Ukusebenzisa i-PPE kakubi
Ukuze sisebenzise iPPE, makhe siqwalasele imeko apho kukho iintlobo ezimbini zabasebenzisi be-repo:
- An umsebenzisi wangaphakathi (umphuhlisi wangaphakathi osebenza kuloo repo), onemvume yokubhala kwi-repo
- An umsebenzisi wangaphandle (umphuhlisi oqeshwe ngaphandle osebenza kuloo repo kodwa enemvume yokufunda kwi-repo), oko kukuthi, akavumelekanga ukuhlukanisa i-repo kwaye unyanzelwa ukuba asebenze kwifoloko.
Masithi bobabini bangabahlaseli abanobubi (okanye bazenza ngathi bangabantu abazenza abantu abanobubi). Le repo iqulethe imfihlo ethile kwaye bobabini bafuna ukweba imfihlo ye-repo baze bayithumele kwiseva elawulwa ngabaphangi. Ukuze bakwenze oko, baza kusebenzisa iPoisoned Pipeline Ubuthathaka bokusebenza kwe pipeline.
Kuzo zombini iimeko (umsebenzisi wangaphandle nowangaphakathi), bavula i- Pull Request kunye notshintsho olufanayo:
- The pipeline kwaye iskripthi segobolondo sitshintshiwe ukuba funda imfihlo ukusuka kwindalo esingqongileyo kunye yithumele kwiseva elawulwa yi-hacker
Utshintsho lungaba ngolu hlobo lulandelayo:
Bobabini abasebenzisi baza kudala Pull Request kunye notshintshoEmva kokudalwa kwe-PR, I-GitHub iza kuphumeza zombini iinguqulelo (ngaphandle kwesidingo sophononongo okanye imvume yangaphambili), oku kuphumela koku kulandelayo:
Kunjalo nakubasebenzisi ababhala nabafundayo, kuzo zombini iimeko i-D-PPE kunye ne-I-PPE ziyasetyenziswa, umahluko kukuba umsebenzisi ofundileyo akanakukwazi ukufikelela kwiimfihlo. (!!!!)
Esi sizathu kukuba, Kwimeko ye-PR evela kwifoloko, iGitHub ayivumeli ukufikelela kwiimfihlo ze-repo. Nangona umsebenzisi ofundayo engakwazi ukufunda iimfihlo, usenokuqhuba nayiphi na enye inkqubo. Umzekelo oqhelekileyo wohlaselo kukudala ii-PR ezikhuphela umvukuzi we-crypto, ngoko ke umgijimi weGitHub uya kusebenzisa umvukuzi we-crypto xa esenza ityhefu. pipeline.
Le ayisiyondawo ikhuselekileyo, ewe!! Yintoni anokuyenza umphathi we-repo ukuze ayiphephe?
Emva kokujonga iGoogle kancinci, umphathi we-repo ugqiba ekubeni atshintshe i- pipeline ukuba iqaliswe kwi tsala_isicelo_esijoliswe kuso isiganeko. Kutheni? Kuba pipelines eqaliswe kwi pull_request_target ayivumeli ukuphunyezwa pipeline ulungiso, oko kukuthi, nangona kukho naluphi na utshintsho lomsebenzisi, "i-original" pipeline iza kuphunyezwa.
Silandela umzekelo wethu, uhlaselo luya kufana nolwangaphambili. Kuza kwenzeka ntoni emva koko pipeline utshintsho?
Njengoko kulindelwe, I-D-PPE ayisebenzi kodwa, kuba i-I-PPE isekhona, umsebenzisi ofundiweyo ngoku uyakwazi ukufikelela kwimfihlo ye-repo!!!
Yintoni isizathu sokuba umsebenzisi ofundileyo ngoku abe nokufikelela kwiimfihlo? Nangona pipeline ayinakuguqulwa, kusenokwenzeka ukutshintsha iskripthi segobolondo. Xa pipeline iyasebenza kwi-pull_request_target, iya kwenziwa kwimo enelungelo so iya kuba sisikripthi segobolondo, nto leyo ebangela ukuba iskripthi segobolondo sibe nokufikelela kwiimfihlo ze-repo!!
Amanyathelo okukhusela
I-GitHub inika amanyathelo athile okukhusela kwi-PRs ezinobungozi.
Imithetho yokukhusela amasebe
NgeGitHub ungachaza iMithetho yoKhuseleko lweSebe ngaphezu kwamasebe akhethiweyo.
Kumasebe akho akhuselweyo, ungacacisa umgaqo-nkqubo othi ifuna a pull request ngaphambi kokudibana (kunye neemeko ezongezelelweyo ezifana nenani elifunekayo leemvume, uphononongo oluvela kubanini bekhowudi, njl.njl.)
Kukho iimeko ezimbalwa ezifanele ukuqwalaselwa ngokukodwa:
- "Vumela abadlali abathile ukuba badlule kwimfuneko pull requests".
- "Musa ukuvumela ukudlula useto olungasentla"
Nangona uninzi lwemiqathango yongeza ubungqongqo kumgaqo-nkqubo, le miqathango iyawukhulula umgaqo-nkqubo kwaye oko kunokukhokelela ekuvulekeni komnyango kwimisebenzi enobungozi, umzekelo, kwimeko apho iziqinisekiso zibiwa ngabadlali “abanelungelo”.
Nciphisa iimvume ze-GITHUB_TOKEN (ilungelo elincinci)
Vimbela iimvume zethokheni zeGitHub kuphela kwezo zifunekayo; ngale ndlela, nokuba abahlaseli bayaphumelela ekubekeni esichengeni pipeline, abayi kukwazi ukwenza okuninzi.
Kuphephe ukutolikwa kwentambo ngokusebenzisa pipeline iinguqu ze-env
Nanini na xa usebenzisa ezinye iinguqu zokufaka kwi-akhawunti yakho pipeline, qaphela ukuba kufuneka zithathwe njengedatha "engathembekanga" (umxholo wazo ulawulwa ngumsebenzisi wokugqibela). Jonga Izenzo ezingathembekanga kunye nokuhamba komsebenzi kukhuselekile kwaye Funda ngezenzo zeGithub.
Kufuneka usebenzise ii-environment variables rhoqo ukufaka ii-input variables ngaphakathi kwi-scripts endaweni yokusebenzisa i-string interpolation.
Iimfuneko zokuqhuba umsebenzi kunye nokuvunywa
kuba kawonke wonke ii-repos, iGitHub ivumela ukucacisa indlela yokusebenza ngee-PR "zangaphandle".
Useto lwe-GitHub Organisation (“Org >> Useto >> Actions >> General”) masichaze indlela yokulawula ii-PR zangaphandle:
Ngokwesiqhelo, iGitHub iya kufuna imvume ye-PR kubantu abafaka izicelo okokuqala, nto leyo eyenza uhlaselo lwezicelo ezinobuthi lube nzima ngakumbi. Nangona kunjalo, umhlaseli angafumana ukuthenjwa ngabagcini beprojekthi umzekelo ngokufaka isandla kwabanye abangenatyala. pull request ngaphambi kohlaselo lokwenyani.
Ngaloo ndlela, i Ukhetho lwesithathu (Ukufuna imvume kubo bonke abasebenzi bangaphandle) longeza inqanaba eliphezulu lolawulo.
kuba abucala Kwi-repos, iGitHub ikwabonelela ngolawulo oluluncedo kwinqanaba le-Organization kunye nele-Repo.
"Sebenzisa ii-Workflows ukusuka kwi Pull Requests"(ayikhangelwanga ngokwendalo) ivumela abasebenzisi ukuba basebenzise imisebenzi yokusebenza ukusuka kwi-fork PRs (besebenzisa i-GITHUB_TOKEN enemvume yokufunda kuphela kwaye engenakufikelela kwiimfihlo). Ngokukhetha olu khetho kunye nolokugqibela ("Funa imvume yokusebenza kwe-fork PRs"), ungafikelela kwipolisi efanayo nee-repos zabucala (njengoko kubonisiwe apha ngasentla).
Njengoko sibonile kwi-PPE exploit evela kumsebenzisi ofundayo, ukuvumela ukuqhuba imisebenzi yokusebenza ukusuka kwifoloko pull requests akukhuselekanga!!
Ezinye iindlela (“Thumela amathokheni okubhala kwimisebenzi yokusebenza ukusuka kwifoloko pull requests"Kwaye"Thumela iimfihlo kunye nezinto eziguquguqukayo kwimisebenzi yokusebenza ukusuka kwi pull requests") yehlisa inqanaba lokhuseleko ifakelwe kwi-PRs zefoloko.
Ungawuchaza lo mgaqo-nkqubo wefoloko nokuba ukwiNqanaba leNtlangano okanye kwiNqanaba leRepo. Ukuba umgaqo-nkqubo ukhutshaziwe kwinqanaba le-org, awunakuvunyelwa kwinqanaba le-repo. Kodwa, ukuba umgaqo-nkqubo uvuliwe kwinqanaba le-org, ungakhutshazwa kwinqanaba le-repo.
Recap
Siyathemba ukuba uzibonile iziphumo zokuba pipeline abasengozini yokuhlaselwa yityhefu Pipeline Ukuphunyezwa. Kulula kakhulu commit umntu obuthathaka pipeline, kwaye kunzima ukubhala ekhuselekileyo.
Ngoko ke kubaluleke kakhulu ukusebenzisa i-Xygeni Scanner ukuze uqaphele ezo ngxaki.
Awunakuyisombulula ingxaki ngaphandle kokuba uyazi ukuba ikhona!!
Kodwa... Kusekho umbuzo osalindelekileyo... Ungayiphepha njani i-I-PPE?
Oku kuza kuba ngumxholo weposi yethu elandelayo 🙂 … Ityhefu Engangqalanga Pipeline Ukuphunyezwa (I-PPE) !!
