Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Executing a script from the master branch is potentially unsafe #25

Open
ximaera opened this issue Jul 10, 2020 · 0 comments
Open

Executing a script from the master branch is potentially unsafe #25

ximaera opened this issue Jul 10, 2020 · 0 comments
Labels
enhancement New feature or request

Comments

@ximaera
Copy link

ximaera commented Jul 10, 2020

https://github.com/google/tsunami-security-scanner/blame/6314ba862884833be797e7e40d97c5b2cfc32101/README.md#L42

Executing scripts from the master branch on the target (production) system is generally considered a bad practice because:

  1. The master/main branch is a routinely updated working branch which at times may not have the bugfixes developed for a release. Therefore, scripts in it might generally contain code which is not properly tested.

  2. The quick_start.sh script does path manipulation. Bugs in path manipulation are known to happen from time to time, with disastrous effects: 1, 2, 3, 4.
    That might potentially be prevented by a sanitizing githook but there are no such hooks in the repository.

  3. The master branch would probably get renamed in the future. Hard-coding a link to it into README.md would unnecessarily complicate the transition with backward compatibility issues.

A suggestion: tag a stable release and link to it instead.

@ximaera ximaera changed the title Executing a script from the master branch is potentially harmful Executing a script from the master branch is potentially unsafe Jul 10, 2020
@tooryx tooryx added the enhancement New feature or request label Jan 9, 2024
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
enhancement New feature or request
Projects
None yet
Development

No branches or pull requests

2 participants