From e9fbdce9b5e857ebc50b6993229da6d54976e21b Mon Sep 17 00:00:00 2001 From: Andrew Rabert Date: Thu, 19 Feb 2026 23:53:50 -0500 Subject: [PATCH] Mitigate pull_request_target privilege escalation MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Hotfix — replaces pull_request_target with pull_request to stop granting write permissions and secrets to fork PRs. Some workflows will break; can be fixed properly later. --- .github/workflows/build.yml | 10 +++++----- 1 file changed, 5 insertions(+), 5 deletions(-) diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml index 13fc914c..45491911 100644 --- a/.github/workflows/build.yml +++ b/.github/workflows/build.yml @@ -5,7 +5,7 @@ concurrency: cancel-in-progress: true on: - pull_request_target: + pull_request: push: branches: [master] @@ -66,7 +66,7 @@ jobs: steps: - name: Add comment uses: thollander/actions-comment-pull-request@24bffb9b452ba05a4f3f77933840a6a841d1b32b # v3.0.1 - if: github.event_name == 'pull_request_target' + if: github.event_name == 'pull_request' with: github-token: ${{ secrets.JF_BOT_TOKEN }} message: | @@ -92,12 +92,12 @@ jobs: apiToken: ${{ secrets.CLOUDFLARE_API_TOKEN }} accountId: ${{ secrets.CLOUDFLARE_ACCOUNT_ID }} command: pages deploy build --project-name=jellyfin-org --branch=${{ - (github.event_name != 'pull_request_target' || github.event.pull_request.head.repo.full_name == github.repository) + (github.event_name != 'pull_request' || github.event.pull_request.head.repo.full_name == github.repository) && (github.event.pull_request.head.ref || github.ref_name) || format('{0}/{1}', github.event.pull_request.head.repo.full_name, github.event.pull_request.head.ref) }} --commit-hash=${{ github.event.pull_request.head.sha || github.sha }} - name: Update status comment (Success) - if: ${{ github.event_name == 'pull_request_target' && success() }} + if: ${{ github.event_name == 'pull_request' && success() }} uses: thollander/actions-comment-pull-request@24bffb9b452ba05a4f3f77933840a6a841d1b32b # v3.0.1 with: github-token: ${{ secrets.JF_BOT_TOKEN }} @@ -113,7 +113,7 @@ jobs: comment-tag: CFPages-deployment mode: recreate - name: Update status comment (Failure) - if: ${{ github.event_name == 'pull_request_target' && failure() }} + if: ${{ github.event_name == 'pull_request' && failure() }} uses: thollander/actions-comment-pull-request@24bffb9b452ba05a4f3f77933840a6a841d1b32b # v3.0.1 with: github-token: ${{ secrets.JF_BOT_TOKEN }}