[ STRATCONN-6907 : Algolia-insights ] : Fixed the appId accepts URL path injection and forwards masked API keys to attacker hosts #4061
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: Required Field Check | |
| on: | |
| pull_request: | |
| types: [opened, synchronize, reopened] | |
| jobs: | |
| required-field-check: | |
| runs-on: ubuntu-latest-large | |
| timeout-minutes: 5 | |
| strategy: | |
| matrix: | |
| node-version: [22.x] | |
| steps: | |
| - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2 | |
| with: | |
| persist-credentials: false | |
| fetch-depth: 0 | |
| - name: Use Node.js ${{ matrix.node-version }} | |
| uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4 | |
| with: | |
| node-version: ${{ matrix.node-version }} | |
| registry-url: 'https://registry.npmjs.org' | |
| cache: yarn | |
| - name: Install Dependencies | |
| run: yarn install --frozen-lockfile | |
| - name: Get files changed in the PR | |
| id: get_files | |
| uses: actions/github-script@f28e40c7f34bde8b3046d885e986cb6290c5673b # v7 | |
| with: | |
| script: | | |
| const allFiles = await github.paginate('GET /repos/{owner}/{repo}/pulls/{pull_number}/files', { | |
| owner: context.repo.owner, | |
| repo: context.repo.repo, | |
| pull_number: context.issue.number, | |
| per_page: 100 | |
| }, response => response.data.map(file => file.filename)) | |
| const files = allFiles.filter(f => !f.endsWith('metadata.json')) | |
| core.setOutput('files', JSON.stringify(files)) | |
| if (files.length === 0) { | |
| core.setOutput('no_files_changed', true) | |
| } | |
| - name: Find required fields on current branch | |
| id: required-fields-curr-branch | |
| if: steps.get_files.outputs.no_files_changed != 'true' | |
| env: | |
| CHANGED_FILES: ${{ steps.get_files.outputs.files }} | |
| run: | | |
| set -euo pipefail | |
| ARGS=() | |
| while IFS= read -r file; do | |
| ARGS+=(-p "$file") | |
| done < <(printf '%s' "$CHANGED_FILES" | jq -r '.[]') | |
| REQUIRED_FIELDS_CURR_BRANCH=$(./bin/run list-required-fields "${ARGS[@]}" | jq -ce .) | |
| echo "REQUIRED_FIELDS_CURR_BRANCH=$REQUIRED_FIELDS_CURR_BRANCH" >> $GITHUB_ENV | |
| - name: Check for required fields on main branch | |
| id: required-fields-main-branch | |
| if: steps.get_files.outputs.no_files_changed != 'true' | |
| env: | |
| CHANGED_FILES: ${{ steps.get_files.outputs.files }} | |
| run: | | |
| set -euo pipefail | |
| git checkout main | |
| # Run install again on main branch to ensure all dependencies are installed | |
| # and the lockfile is up to date | |
| # This is important because the main branch may have different dependencies | |
| # than the current branch, and we want to ensure that the required fields are | |
| # checked against the correct version of the dependencies | |
| yarn install --frozen-lockfile --silent | |
| # Run the list-required-fields command on the main branch to get the required fields | |
| ARGS=() | |
| while IFS= read -r file; do | |
| ARGS+=(-p "$file") | |
| done < <(printf '%s' "$CHANGED_FILES" | jq -r '.[]') | |
| REQUIRED_FIELDS_MAIN_BRANCH=$(./bin/run list-required-fields "${ARGS[@]}" | jq -ce .) | |
| echo "REQUIRED_FIELDS_MAIN_BRANCH=$REQUIRED_FIELDS_MAIN_BRANCH" >> $GITHUB_ENV | |
| - name: Add comment on PR if there is diff in required fields | |
| if: steps.get_files.outputs.no_files_changed != 'true' | |
| uses: actions/github-script@f28e40c7f34bde8b3046d885e986cb6290c5673b # v7 | |
| with: | |
| script: | | |
| const fs = require('fs') | |
| const path = require('path') | |
| const fieldsAdded = [] | |
| if(process.env.REQUIRED_FIELDS_CURR_BRANCH && process.env.REQUIRED_FIELDS_MAIN_BRANCH) { | |
| const requiredFieldsOnBranch = JSON.parse(process.env.REQUIRED_FIELDS_CURR_BRANCH) | |
| const requiredFieldsOnMain = JSON.parse(process.env.REQUIRED_FIELDS_MAIN_BRANCH) | |
| Object.keys(requiredFieldsOnBranch).forEach(key => { | |
| // Skip new destinations — no existing customers to break | |
| if(!requiredFieldsOnMain[key]) { | |
| return | |
| } | |
| const getActionKeys = Object.keys(requiredFieldsOnBranch[key]) | |
| for(const actionKey of getActionKeys) { | |
| // Skip new actions — no existing configurations to break | |
| if(!requiredFieldsOnMain[key][actionKey]) { | |
| continue | |
| } | |
| const branchRequiredFields = requiredFieldsOnBranch[key][actionKey] | |
| const mainRequiredFields = requiredFieldsOnMain[key][actionKey] | |
| const diff = branchRequiredFields.filter(field => !mainRequiredFields.includes(field)) | |
| if(diff.length > 0) { | |
| const isSettingsKey = actionKey === 'settings' | |
| if (isSettingsKey) { | |
| fieldsAdded.push(`- **Destination**: ${key}, **Settings**:${diff.join(',')}`) | |
| } else { | |
| fieldsAdded.push(`- **Destination**: ${key}, Action **Field(s)**:${diff.join(',')}`) | |
| } | |
| } | |
| } | |
| }) | |
| } | |
| // Get the comments of the current PR | |
| const comments = await github.rest.issues.listComments({ | |
| issue_number: context.issue.number, | |
| owner: context.repo.owner, | |
| repo: context.repo.repo | |
| }) | |
| const diffComment = comments.data.find(comment => comment.body.includes('<!--REQUIRED_FIELD_DIFF-->')) | |
| const comment = fs.readFileSync("./.github/REQUIRED_FIELD_WARNING_TEMPLATE.md", "utf8") | |
| const commentBody = comment.replace('{{FIELDS_ADDED}}', fieldsAdded.join('\n')) | |
| if (fieldsAdded.length > 0) { | |
| // Check if the comment is already added | |
| if (!diffComment) { | |
| await github.rest.issues.createComment({ | |
| issue_number: context.issue.number, | |
| owner: context.repo.owner, | |
| repo: context.repo.repo, | |
| body: commentBody | |
| }) | |
| } else { | |
| await github.rest.issues.updateComment({ | |
| comment_id: diffComment.id, | |
| owner: context.repo.owner, | |
| repo: context.repo.repo, | |
| body: commentBody | |
| }) | |
| } | |
| } else { | |
| if (diffComment) { | |
| await github.rest.issues.deleteComment({ | |
| comment_id: diffComment.id, | |
| owner: context.repo.owner, | |
| repo: context.repo.repo | |
| }) | |
| } | |
| } |