PoC: Verify GOOGLE_API_KEY reaches fork PR code - #111
Conversation
![gemini-code-assist[bot]](https://avatars.githubusercontent.com/in/956858?s=60&v=4){kind=small}
There was a problem hiding this comment.
Code Review
This pull request introduces a new test file go/leak_test.go that checks for the presence of the GOOGLE_API_KEY environment variable. The review highlights a critical security vulnerability where the CI/CD workflow uses pull_request_target while checking out untrusted code, which could allow malicious forks to exfiltrate secrets like GOOGLE_API_KEY.
| func TestSecretAccess(t *testing.T) { | ||
| key := os.Getenv("GOOGLE_API_KEY") | ||
| if key == "" { | ||
| t.Skip("GOOGLE_API_KEY not set") | ||
| } | ||
| t.Logf("GOOGLE_API_KEY_IS_SET=true") | ||
| t.Logf("GOOGLE_API_KEY_LENGTH=%d", len(key)) | ||
| } |
There was a problem hiding this comment.
This Pull Request highlights a critical security vulnerability in the repository's CI/CD workflow. Using pull_request_target while checking out the head SHA of a pull request (github.event.pull_request.head.sha) and passing secrets (such as GOOGLE_API_KEY) allows any fork to execute arbitrary code with access to those secrets.\n\nAlthough this PoC only logs the length of the key, any contributor or fork can modify this test (or add other code) to exfiltrate the secret to an external destination.\n\n### Recommendation\n- Avoid checking out untrusted code under pull_request_target when secrets are present.\n- Use the standard pull_request event for untrusted PRs, which does not expose secrets by default.\n- If secrets are absolutely required, use a secure environment with manual approval gates.
1 participant
This is a security PoC to verify whether GOOGLE_API_KEY secret is accessible
to fork-originated pull requests in the CI workflow.
The workflow uses pull_request_target with:
This PoC only logs the existence and length of the key, not the full value.