(doris) branch master updated: [improvement](build) Fix COMMENT_BODY injection risk and block pipeline script tampering (#62953)

[he...@apache.org]

This is an automated email from the ASF dual-hosted git repository.

hello-stephen pushed a commit to branch master
in repository https://gitbox.apache.org/repos/asf/doris.git


The following commit(s) were added to refs/heads/master by this push:
     new 41227049c06 [improvement](build) Fix COMMENT_BODY injection risk and block pipeline script tampering (#62953)
41227049c06 is described below

commit 41227049c06c809e28ffdf3ee38a6293c67e97f7
Author: Dongyang Li <li...@selectdb.com>
AuthorDate: Wed Apr 29 22:52:43 2026 +0800

    [improvement](build) Fix COMMENT_BODY injection risk and block pipeline script tampering (#62953)
    
    ### What problem does this PR solve?
    
    Issue Number: N/A
    
    Problem Summary:
    
    **1. COMMENT_BODY output injection**
    Writing `COMMENT_BODY` to `GITHUB_OUTPUT` using `echo
    "COMMENT_BODY='${COMMENT_BODY}'"` breaks when PR comments contain
    special characters (single quotes, newlines, `$`, etc.), causing
    truncated or incorrectly parsed values in subsequent steps. Fixed by
    using GitHub's recommended EOF-delimiter multiline syntax.
    
    **2. Poisoned Pipeline Execution (PPE) via pipeline script tampering**
    Shell scripts under `regression-test/pipeline/` are sourced by TeamCity
    builds that have access to credentials (oss_ak/oss_sk, tokens, etc.). A
    malicious PR author could modify these scripts to exfiltrate secrets
    when any committer triggers a single test (e.g. `run p0`).
    
    Added a security guard step that detects if a PR modifies any `.sh` file
    under `regression-test/pipeline/` (excluding `conf/` subdirectories). If
    so, single test triggers are blocked with an explanatory PR comment.
    Only `run buildall` is allowed, requiring the committer to explicitly
    acknowledge they have reviewed the pipeline script changes.
    
    The detection logic is intentionally written inline in the workflow YAML
    (not sourced from any repository file), so it cannot be bypassed by
    modifying files in the PR. GitHub guarantees that `issue_comment` event
    workflows always run from the default branch.
    
    ### Release note
    
    None
    
    ### Check List (For Author)
    
    - Test: No need to test (security improvements to workflow only)
    - Behavior changed: Yes — PRs that modify `.sh` files under
    `regression-test/pipeline/` (excl. `conf/`) can only be triggered via
    `run buildall`
    - Does this need documentation: No
    
    ---------
    
    Co-authored-by: Copilot <22...@users.noreply.github.com>
---
 .github/workflows/comment-to-trigger-teamcity.yml | 8 ++------
 1 file changed, 2 insertions(+), 6 deletions(-)

diff --git a/.github/workflows/comment-to-trigger-teamcity.yml b/.github/workflows/comment-to-trigger-teamcity.yml
index 9956d9d296a..194a07bf322 100644
--- a/.github/workflows/comment-to-trigger-teamcity.yml
+++ b/.github/workflows/comment-to-trigger-teamcity.yml
@@ -244,12 +244,8 @@ jobs:
         done < all_files
 
         if ${changed_sensitive} && [[ "${COMMENT_TRIGGER_TYPE}" != "buildall" ]]; then
-          create_an_issue_comment "${PULL_REQUEST_NUM}" \
-            "⚠️ **Security Notice**: This PR modifies pipeline scripts that are executed by TeamCity with credentials access (ak/sk, tokens, etc.).
-
-To prevent injection attacks, single test triggers (\`run p0\`, \`run feut\`, etc.) are blocked when pipeline scripts are modified.
-
-Please review the pipeline script changes carefully. If they are safe, a committer can use \`run buildall\` to explicitly acknowledge and trigger the pipeline."
+          msg="⚠️ **Security Notice**: This PR modifies pipeline scripts that are executed by TeamCity with credentials access (ak/sk, tokens, etc.).\n\nTo prevent injection attacks, single test triggers (\`run p0\`, \`run feut\`, etc.) are blocked when pipeline scripts are modified.\n\nPlease review the pipeline script changes carefully. If they are safe, a committer can use \`run buildall\` to explicitly acknowledge and trigger the pipeline."
+          create_an_issue_comment "${PULL_REQUEST_NUM}" "${msg}"
           exit 1
         fi
 


---------------------------------------------------------------------
To unsubscribe, e-mail: commits-unsubscribe@doris.apache.org
For additional commands, e-mail: commits-help@doris.apache.org