Security issue
Nobody has claimed this yet.
- Dominant language
- TypeScript
- Stars
- 1.5k
- Forks
- 308
- Avg merge
- 47m
- Merged PRs (30d)
- 1
Description
Coming from docker/build-push-action#53
Refs:
- docker/login-action#25
- docker/github-actions#21
- actions/starter-workflows#96
Behaviour
https://github.com/docker/build-push-action/issues/53#issuecomment-721898162
It seems that the warning message is hidden from the users, which is misleading as it provides a false feeling of security. As seen in docker/login-action@adb7347/src/docker.ts#L36, on success stderr is not shown. The warning is precisely shown when the login is successful but insecure.
Steps to reproduce this issue
https://github.com/docker/build-push-action/issues/53#issuecomment-721898162
See eine/login-action@master(commits) and eine/login-action/runs/1354438643?check_suite_focus=true#step:3:8.
Expected behaviour
Login is secure or security warnings are not hidden.
Actual behaviour
Login is reported not to be secure, but warnings are hidden.
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Start with src/docker.ts#L36 in docker/login-action and review how successful login output handles stderr. Reproduce the behavior using the linked eine/login-action workflow run and compare it with the referenced build-push-action and related issues. Done means the login result and any security warning are reported consistently without hiding relevant stderr.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- docker, github-actions, typescript
- Domain
- ci-cd, devops, security
- Issue type
- Bug
- Difficulty
- 3/5
- Estimated time
- 1-2 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 35/100