You are viewing a plain text version of this content. The canonical link for it is here.
Posted to commits@doris.apache.org by "hello-stephen (via GitHub)" <gi...@apache.org> on 2026/04/29 14:39:56 UTC
[PR] [improvement](build) Fix COMMENT_BODY injection risk and block pipeline script tampering [doris]
hello-stephen opened a new pull request, #62953:
URL: https://github.com/apache/doris/pull/62953
### What problem does this PR solve?
Issue Number: N/A
Problem Summary:
**1. COMMENT_BODY output injection**
Writing `COMMENT_BODY` to `GITHUB_OUTPUT` using `echo "COMMENT_BODY='${COMMENT_BODY}'"` breaks when PR comments contain special characters (single quotes, newlines, `$`, etc.), causing truncated or incorrectly parsed values in subsequent steps. Fixed by using GitHub's recommended EOF-delimiter multiline syntax.
**2. Poisoned Pipeline Execution (PPE) via pipeline script tampering**
Shell scripts under `regression-test/pipeline/` are sourced by TeamCity builds that have access to credentials (oss_ak/oss_sk, tokens, etc.). A malicious PR author could modify these scripts to exfiltrate secrets when any committer triggers a single test (e.g. `run p0`).
Added a security guard step that detects if a PR modifies any `.sh` file under `regression-test/pipeline/` (excluding `conf/` subdirectories). If so, single test triggers are blocked with an explanatory PR comment. Only `run buildall` is allowed, requiring the committer to explicitly acknowledge they have reviewed the pipeline script changes.
The detection logic is intentionally written inline in the workflow YAML (not sourced from any repository file), so it cannot be bypassed by modifying files in the PR. GitHub guarantees that `issue_comment` event workflows always run from the default branch.
### Release note
None
### Check List (For Author)
- Test: No need to test (security improvements to workflow only)
- Behavior changed: Yes — PRs that modify `.sh` files under `regression-test/pipeline/` (excl. `conf/`) can only be triggered via `run buildall`
- Does this need documentation: No
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@doris.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: commits-unsubscribe@doris.apache.org
For additional commands, e-mail: commits-help@doris.apache.org
Re: [PR] [improvement](build) Fix COMMENT_BODY injection risk and block pipeline script tampering [doris]
Posted by "hello-stephen (via GitHub)" <gi...@apache.org>.
hello-stephen commented on PR #62953:
URL: https://github.com/apache/doris/pull/62953#issuecomment-4344768677
skip buildall
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@doris.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: commits-unsubscribe@doris.apache.org
For additional commands, e-mail: commits-help@doris.apache.org
Re: [PR] [improvement](build) Fix COMMENT_BODY injection risk and block pipeline script tampering [doris]
Posted by "hello-stephen (via GitHub)" <gi...@apache.org>.
hello-stephen commented on PR #62953:
URL: https://github.com/apache/doris/pull/62953#issuecomment-4344757342
Thank you for your contribution to Apache Doris.
Don't know what should be done next? See [How to process your PR](https://cwiki.apache.org/confluence/display/DORIS/How+to+process+your+PR).
Please clearly describe your PR:
1. What problem was fixed (it's best to include specific error reporting information). How it was fixed.
2. Which behaviors were modified. What was the previous behavior, what is it now, why was it modified, and what possible impacts might there be.
3. What features were added. Why was this function added?
4. Which code was refactored and why was this part of the code refactored?
5. Which functions were optimized and what is the difference before and after the optimization?
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@doris.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: commits-unsubscribe@doris.apache.org
For additional commands, e-mail: commits-help@doris.apache.org
Re: [PR] [improvement](build) Fix COMMENT_BODY injection risk and block pipeline script tampering [doris]
Posted by "hello-stephen (via GitHub)" <gi...@apache.org>.
hello-stephen merged PR #62953:
URL: https://github.com/apache/doris/pull/62953
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@doris.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: commits-unsubscribe@doris.apache.org
For additional commands, e-mail: commits-help@doris.apache.org