You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Executing scripts from the master branch on the target (production) system is generally considered a bad practice because:
The master/main branch is a routinely updated working branch which at times may not have the bugfixes developed for a release. Therefore, scripts in it might generally contain code which is not properly tested.
The quick_start.sh script does path manipulation. Bugs in path manipulation are known to happen from time to time, with disastrous effects: 1, 2, 3, 4.
That might potentially be prevented by a sanitizing githook but there are no such hooks in the repository.
The master branch would probably get renamed in the future. Hard-coding a link to it into README.md would unnecessarily complicate the transition with backward compatibility issues.
A suggestion: tag a stable release and link to it instead.
The text was updated successfully, but these errors were encountered:
ximaera
changed the title
Executing a script from the master branch is potentially harmful
Executing a script from the master branch is potentially unsafe
Jul 10, 2020
https://github.com/google/tsunami-security-scanner/blame/6314ba862884833be797e7e40d97c5b2cfc32101/README.md#L42
Executing scripts from the
master
branch on the target (production) system is generally considered a bad practice because:The
master
/main
branch is a routinely updated working branch which at times may not have the bugfixes developed for a release. Therefore, scripts in it might generally contain code which is not properly tested.The
quick_start.sh
script does path manipulation. Bugs in path manipulation are known to happen from time to time, with disastrous effects: 1, 2, 3, 4.That might potentially be prevented by a sanitizing githook but there are no such hooks in the repository.
The
master
branch would probably get renamed in the future. Hard-coding a link to it intoREADME.md
would unnecessarily complicate the transition with backward compatibility issues.A suggestion: tag a stable release and link to it instead.
The text was updated successfully, but these errors were encountered: