際際滷

際際滷Share a Scribd company logo

Ivan Vyshnevskyi - Not So Quiet Git Push

OWASP Kyiv
OWASP Kyiv

Ivan Vyshnevskyi - Not So Quiet Git Push

1 of 127
Download to read offline
Not so Quiet git push All your repository are belong to us
亟仄仂于舒 于亟 于亟仗仂于亟舒仍仆仂 They are not a security people, theyre a developer people [] Bryan Brake, 仗仂亟从舒 Brakeing Down Security 2
3
4
5
6
7 仂亟亠仍 亰舒亞仂亰
仍舒仆 I. 仂弍仍亠仄舒 II. 仂 III.亠亰仍舒亳 8
I. 仂弍仍亠仄舒 9
丶仍: 舒亳仆亳亶 舒亶 亠仂仆舒仍仆亳亶 弍仍仂亞 C舒亶-于亰亳从舒 仂从仄亠仆舒 亟仍 仆舒仂亞仂 F(L)OSS 仗仂亠从 弌仂仆从舒 亟仍 JavaScript 亠从仗亠亳仄亠仆于 10
丶仍: 舒亳仆亳亶 舒亶 亠亠于仂 仆仄仄 仆舒从亳 亠亞从仂 仂仆仂于仍ﾐ火委亳 亳亠仄仂 仆亠 亳亳亶 HTML (Markdown 亳 AsciiDoc) 11
GitHub Pages 12
GitHub Pages v1.0 13 舒于仂 https://example.github.io 亰仄仆亳 仂亳仆亞 GitHub 亞亠仆亠舒 (Jekyll)
GitHub Pages v2.0 14 舒于仂 https://example.github.io 亰仄仆亳 GitHub Travis CI 仂亳仆亞 亞亠仆亠舒 舒 仗弍仍从舒 仂亳仄舒仆仆 亰仄仆
GitHub Pages: Auth 15
GitHub Pages: Auth 16
GitHub Pages: Auth 17
弍仍从舒 亰 Travis CI 18 .travis.yml sudo: false script: - ./build.sh # 亞亠仆亠 从仂仄仄亳 于 public - cd public - ???
弍仍从舒: 仗仂弍舒 #1 19 .travis.yml:L5 - git push https://$GH_TOKEN@github.com/$TRAVIS_REPO_SLUG HEAD:gh-pages
弍仍从舒: 仗仂弍舒 #1 20
弍仍从舒: 仗仂弍舒 #1 21
弍仍从舒: 仗仂弍舒 #1 22
git push 亟仂 v2.9.3 于亳于仂亟亳 仗仂于仆亳亶 URL 23
弍仍从舒: 仗仂弍舒 #2 24
弍仍从舒: 仗仂弍舒 #2 25 man git-push
弍仍从舒: 仗仂弍舒 #2 26 .travis.yml:L5 - git push --quiet https://$GH_TOKEN@github.com/$TRAVIS_REPO_SLUG HEAD:gh-pages
弍仍从舒: 仗仂弍舒 #2 27
弍仍从舒: 仗仂弍舒 #2 28
弍仍从舒: 仗仂弍舒 #2 29
弍仍从舒: 仗仂弍舒 #2 30
弍仍从舒: 仗仂弍舒 #2 31 man git-push #again
git push 于亠 于亳于仂亟亳 仗仂于仆亳亶 URL 仗亳 仗仂仄亳仍 32
弍仍从舒: 仗仂弍舒 #3 33
弍仍从舒: 仗仂弍舒 #3 34 .travis.yml:L5 - git push --quiet https://$GH_TOKEN@github.com/$TRAVIS_REPO_SLUG HEAD:gh-pages > /dev/null
弍仍从舒: 仗仂弍舒 #3 35 git push --quiet $URL HEAD:gh-pages > /dev/null fatal: unable to access 'https://df479efa868fbb679ce954fad0ce2c7c3dffd92e@github.com/sai naen/hypothetical-blog/': Failed to connect to github.com port 443: Connection refused
弍仍从舒: 仗仂弍舒 #3 36 git push --quiet $URL HEAD:gh-pages > /dev/null fatal: unable to access 'https://df479efa868fbb679ce954fad0ce2c7c3dffd92e@github.com/sai naen/hypothetical-blog/': Failed to connect to github.com port 443: Connection refused
git push 于亠 于亳于仂亟亳 仗仂仄亳仍从亳 于 stderr, 仆亠 stdout 37
弍仍从舒: 亠 于舒舒仆亳? 38 仗仂于仆亳亶 /dev/null git push $URL HEAD:gh-pages 2>&1 > /dev/null credentials helper git config credential.helper 'store --file=.git/creds' ~/.netrc echo "machine github.com login $LOGIN password $GH_TOKEN" > ~/.netrc
亟仄仂从 乂仂弍 仗舒ﾐ火委亳 亰 git 弍亠亰仗亠仆仂 亠弍舒 弍亳 仂弍亠亠亢仆亳仄 丱仂仂 亠仆仆 亰仆舒亶亳 舒从 舒仄仂 仍亠亞从仂 磻 仗仂亞舒仆 仂仗仆 亟仍 于 仍仂亞亳 仆亠 仗仂ﾑ 亰舒亟舒 39
II. 仂 40
2014 仆舒亶仂仄于仂 41
2014 仆舒亶仂仄于仂 42
2014 仆舒亶仂仄于仂 仂亳亶 仗仂从 仗仂 git push https 亠亠亞仍磲 于仆 仍仂亞于 43
2014 仆舒亶仂仄于仂 仂亳亶 仗仂从 仗仂 git push https 亠亠亞仍磲 于仆 仍仂亞于 亠亰仍舒: ~10 仂从亠仆于 (舒从亳于仆亳 仆) 44
2014 仆舒亶仂仄于仂 仂亟仆仂仄 亰 仍亳于, 仆舒仗亳舒于: [This problem] doesn't seem to be very common [] 45
2014 仆舒亶仂仄于仂 仂亟仆仂仄 亰 仍亳于, 仆舒仗亳舒于: [This problem] doesn't seem to be very common [] 丱舒! 46
2016 仂于亠仆亠仆仆 47 丱仂亠 于亶 弍仍仂亞 亠亳亶 仗仂 仄舒 弍亳 仗仂 仂 从舒于亠
2016 仂于亠仆亠仆仆 48 丱仂亠 于亶 弍仍仂亞 亠亳亶 仗仂 仄舒 弍亳 仗仂 仂 从舒于亠 仂弍仍亠仄舒 亰 git push
2016 仂于亠仆亠仆仆 49 仂亞仂 10 仂从亠仆于 磻仂 仄舒仍于舒仂 仂亢仍亳于仂 亰舒 亟于舒 仂从亳 于亠 亰仄仆亳仍仂? 仂亠仆亶仆舒 从仂亟舒, 磻仂 仗仂弍仍亠仄舒 弍仍 仗仂亳亠仆舒
2016 仂于亠仆亠仆仆 50 仂亞仂 10 仂从亠仆于 磻仂 仄舒仍于舒仂 仂亢仍亳于仂 亰舒 亟于舒 仂从亳 于亠 亰仄仆亳仍仂? 仂亠仆亶仆舒 从仂亟舒, 磻仂 仗仂弍仍亠仄舒 弍仍 仗仂亳亠仆舒 亠仆仆: 亠 舒亰 仗仂亶亳 仗仂从仂仄
2016 亠 亠亰仍舒亳 28 舒从亳于仆亳 仂从亠仆于 51
2016 亠 亠亰仍舒亳 28 舒从亳于仆亳 仂从亠仆于 舒从仂于舒 舒于仂仄舒亳亰舒 亰舒于舒仆舒亢亠仆仆 仍仂亞于 52
2016 亠 亠亰仍舒亳 28 舒从亳于仆亳 仂从亠仆于 舒从仂于舒 舒于仂仄舒亳亰舒 亰舒于舒仆舒亢亠仆仆 仍仂亞于 亰仆舒ﾑ亳 仄 亠仗仂亰亳仂, 仆舒于 磻仂 于仆 束亟亠舒从亳于仂于舒仆亳亶損 仆舒 Travis CI, 仍仂亞亳 于亠 亠 仄仂亢仆舒 仂亳仄舒亳 于亳仗舒亟从 仗仂弍仍亠仄 亰 git push 磻亳亶 亰仆舒仂亟亳 于 after_success 亠从, 弍仍亟 亰舒仍亳舒 束亰亠仍亠仆亳仄損 53
2016 亠 亠亰仍舒亳 28 舒从亳于仆亳 仂从亠仆于 舒从仂于舒 舒于仂仄舒亳亰舒 亰舒于舒仆舒亢亠仆仆 仍仂亞于 亰仆舒ﾑ亳 仄 亠仗仂亰亳仂, 仆舒于 磻仂 于仆 束亟亠舒从亳于仂于舒仆亳亶損 仆舒 Travis CI, 仍仂亞亳 于亠 亠 仄仂亢仆舒 仂亳仄舒亳 于亳仗舒亟从 仗仂弍仍亠仄 亰 git push 磻亳亶 亰仆舒仂亟亳 于 after_success 亠从, 弍仍亟 亰舒仍亳舒 束亰亠仍亠仆亳仄損 coordinated 舒 仆 于亳亟亳 disclosure 54
2016 仆亳亞舒 仂弍仍亳 exec('git clone '+ 'https://$GH_TOKEN@github.com/'+repoSlug+' '+ factsFolder); // ... exec('git push origin'); 55
2016 仆亳亞舒 仂弍仍亳 56 仂亢仆舒 仗亳舒亳 舒! :-)
2016 仆亳亞舒 仂弍仍亳 57 仂亢仆舒 仗亳舒亳 舒! :-) 舒亞 弍舒仆? 从仂!
2016 仆亳亞舒 仂弍仍亳 58 仂亢仆舒 仗亳舒亳 舒! :-) 舒亞 弍舒仆? 亟 仍仂于 , 弍舒 束亠 仄仂亢仆舒 亰于磶于舒亳 亰 仗舒于仆亳从舒仄亳 亰 仗亳舒仆 仗仂于亟仂仄仍亠仆仆 弍亠亰仗仂亠亠亟仆仂 舒弍仂 亠亠亰 仆 从舒仆舒仍亳.損 仂仄亳仍从舒 于亢亠 于亳仗舒于仍亠仆舒
2016 仆亳亞舒 仂弍仍亳 59 Thank you for reporting this information to us.
2016 仆亳亞舒 仂弍仍亳 60 Thank you for reporting this information to us.
2016 仆亳亞舒 仂弍仍亳 61 Thank you for reporting this information to us. After reviewing this issue, we have decided to award you a bounty of $X000.
2016 仆亳亞舒 仂弍仍亳 62 award you a bounty of $X000
2016 仆亳亞舒 仂弍仍亳 63
2016 仆亳亞舒 仂弍仍亳 64
2017 弌从舒仆 65
2017 弌从舒仆 66 JavaScript: 仂弍仂舒 亰 API Travis CI Bash: 仄亠仆亟亢仄亠仆 于于仂亟/于亳于仂亟 俗_()_/俗
2017 弌从舒仆: 亠仗仂亰亳仂 67 仗仂仗仍仆 (>100 亰仂仂从 亳 仂从于)
2017 弌从舒仆: 亠仗仂亰亳仂 68 仗仂仗仍仆 (>100 亰仂仂从 亳 仂从于) 仗仂亠从亳 于亟仂仄亳 从仂仄仗舒仆亶 (Google, Mozilla, Facebook, etc.)
2017 弌从舒仆: 亠仗仂亰亳仂 69 仗仂仗仍仆 (>100 亰仂仂从 亳 仂从于) 仗仂亠从亳 于亟仂仄亳 从仂仄仗舒仆亶 (Google, Mozilla, Facebook, etc.) 仗仂亠从亳 仂仗-从仂仄仄亠于 亟仂 仗仂亠从于 亰弍舒仆亳 舒仆亠
2017 弌从舒仆: 亠仗仂亰亳仂 70
2017 弌从舒仆: 亠仗仂亰亳仂 71 仗仂仗仍仆 (>100 亰仂仂从 亳 仂从于) 仗仂亠从亳 于亟仂仄亳 从仂仄仗舒仆亶 (Google, Mozilla, Facebook, etc.) 仗仂亠从亳 仂仗-从仂仄仄亠于 亟仂 仗仂亠从于 亰弍舒仆亳 舒仆亠 仗仂亠从亳 从仂仄仄亠于 亟仂 仗仂亠从于 仂仗-从仂仄仄亠于
2017 弌从舒仆: 弍仍亟亳 72 亠磻 仗仂亠从亳 于亳从仂亳仂于ﾑ Travis CI 仆舒仗仂于仆 仆从仂仍亳 亟亠从亳 亳 弍仍亟于 从仂亢亠仆 弍仍亟 仄舒 亟亠从亳 亟亢仂弍 仍仂亞于
2017 弌从舒仆: 弍仍亟亳 73 仍从亳 仂舒仆仆 3000 弍仍亟于 仆亠 弍仍亠 10 仍仂亞于 仆舒 弍仍亟 亰舒于亢亟亳 仂舒仆仆亶 舒 仗亠亳亶 8 于亳仗舒亟从仂于亳
2017 弌从舒仆: 舒 74 ~4 仄 仂弍 仆亠 亰舒弍舒仆亳仍亳 仄亶 亠于亠 仆亠 于仂ﾐ火委亳 仗仂弍仍亠仄 亟仍 弍亠亰从仂仂于仆仂亞仂 亠于
2017 弌从舒仆: 舒 75 ~4 仄 仂弍 仆亠 亰舒弍舒仆亳仍亳 仄亶 亠于亠 仆亠 于仂ﾐ火委亳 仗仂弍仍亠仄 亟仍 弍亠亰从仂仂于仆仂亞仂 亠于 亟亢亠 于舒亢从仂 仆亠 亳亟亳 仗仂 亟亳于亳亳 磻 弍亢舒 磲仂从亳
2017 弌从舒仆: 舒 76 ~4 仄 仂弍 仆亠 亰舒弍舒仆亳仍亳 仄亶 亠于亠 仆亠 于仂ﾐ火委亳 仗仂弍仍亠仄 亟仍 弍亠亰从仂仂于仆仂亞仂 亠于 亟亢亠 于舒亢从仂 仆亠 亳亟亳 仗仂 亟亳于亳亳 磻 弍亢舒 磲仂从亳 仗仂亶仆亳亶 亰弍 仆仂于亳 束仍亠亶損
III. 亠亰仍舒亳 77
丱于亳仍亳仆从舒 舒亳亳从亳 (1) 78 弌从舒仆 7.8 仄仍亶仂仆于 亠仗仂亰亳仂于 仆舒 326 仄仂于舒 320 亳. 亰 仆亳 仄舒仍亳 仂舒 弍 仂亟亳仆 弍仍亟 仆舒 Travis CI ~4.1%! 60 仄仍亶仂仆于 弍仍亟于
丱于亳仍亳仆从舒 舒亳亳从亳 (2) 79 亠亰仍舒亳 150 亳. 弍仍亟于 于 磻亳 仂 亰仆舒亶仍亳 ~0.24% 于亟 2.6 亳. 仆从舒仍仆亳 仂从亠仆于 907 舒从亳于仆亳 仂从亠仆于 (34%)
907 从亳于仆亳 仂从亠仆于 80
81
82 从舒于 仗仂亠从亳
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113 158 亳. 亠仗仂亰亳仂于 亰 从仂仄仄-亟仂仗仂仄
114 20 亳. 仗亳于舒仆亳 亠仗仂亰亳仂于
disclosure 115
Disclosure: 仗仂磲仂从 116 1. 亞舒亰亠亳/亢仆舒仍亳/仂仆仍舒亶仆 于亳亟舒仆仆 2. 亟亠亢舒于仆 仂亞舒仆亰舒 3. 于亠仍亳从 从仂仄仗舒仆 4. 仆亟亳于亟舒仍仆 仂亰仂弍仆亳从亳
Disclosure: 舒 仂仄 仆亠 117 git-security@ Travis CI GitHub Security 仆舒仗礆 于仍舒仆亳从舒仄
Disclosure: 仄仂仄亠仆亳 118 于亳磦亳仍仂, 亠 亰舒亶仄舒 亟亢亠 弍舒亞舒仂 舒
Disclosure: 仄仂仄亠仆亳 119 于亳磦亳仍仂, 亠 亰舒亶仄舒 亟亢亠 弍舒亞舒仂 舒 于舒亢从仂 于亳亰仆舒亳亳 从仂仄 仗亳舒亳
Disclosure: 仄仂仄亠仆亳 120 于亳磦亳仍仂, 亠 亰舒亶仄舒 亟亢亠 弍舒亞舒仂 舒 于舒亢从仂 于亳亰仆舒亳亳 从仂仄 仗亳舒亳 Google Security Team 从
Disclosure: 仆舒仍 121
亳仆仂于从亳 122 given enough eyeballs, all bugs are shallow 仆亠 仗舒ﾑ, 仂从亠仆亳 于 仍仂亞舒 弍仍亳 仂从舒仄亳 仆舒于 于亠仍亳从亳 仗仂亠从于
亳仆仂于从亳 123 given enough eyeballs, all bugs are shallow 仆亠 仗舒ﾑ, 仂从亠仆亳 于 仍仂亞舒 弍仍亳 仂从舒仄亳 仆舒于 于亠仍亳从亳 仗仂亠从于 磻仂 仗仂亞舒仄舒 仗仂于仂亟亳 仆亠仗仂亟于舒仆仂, 亟仂从仄亠仆舒 仆亠 仗仂亳舒ﾑ
亳仆仂于从亳 124 given enough eyeballs, all bugs are shallow 仆亠 仗舒ﾑ, 仂从亠仆亳 于 仍仂亞舒 弍仍亳 仂从舒仄亳 仆舒于 于亠仍亳从亳 仗仂亠从于 磻仂 仗仂亞舒仄舒 仗仂于仂亟亳 仆亠仗仂亟于舒仆仂, 亟仂从仄亠仆舒 仆亠 仗仂亳舒ﾑ 从仂仗-仗舒舒 从仂亟 亰 仆亠仆亠, 磻 亰舒于亢亟亳, 仆亠 亟仂仗仂仄仂亞舒
磻 亰舒 于舒亞 125 hi@sainaen.com @sainaen 于舒仆 亳仆亠于从亳亶
PS. 亠 git push 亟亳仆亳仄 set -x git remote -v echo 126
PPS. 亳仗舒于亳仄仂 git-push! - error(_("failed to push some refs to '%s'"), transport->url); + error(_("failed to push some refs to '%s'"), transport_anonymize_url(transport- >url)); This leaks the return value. :-( 127

More Related Content

Ivan Vyshnevskyi - Not So Quiet Git Push