Description:
In #1348, caching was enabled by default if the package.json includes the packageManager field.
This side-effect is dangerous in privileged workflows with access to secrets and credentials, because it makes them vulnerable to cache poisoning. Code injection in one privileged workflow can be exploited to steal higher value secrets, and credentials in another privileged workflow.
Action version:
v5.0.0
Platform:
Runner type:
Tools version:
npm (but issue is not specific)
Repro steps:
- Create a repo with
package.json incl. packageManager field.
- Create a
pull_request_target workflow incl. actions/setup-node usage.
Expected behavior:
Caching should not be enabled by default in privileged workflows.
Actual behavior:
Caching is enabled by default.
Description:
In #1348, caching was enabled by default if the
package.jsonincludes thepackageManagerfield.This side-effect is dangerous in privileged workflows with access to secrets and credentials, because it makes them vulnerable to cache poisoning. Code injection in one privileged workflow can be exploited to steal higher value secrets, and credentials in another privileged workflow.
Action version:
v5.0.0
Platform:
Runner type:
Tools version:
npm (but issue is not specific)
Repro steps:
package.jsonincl.packageManagerfield.pull_request_targetworkflow incl.actions/setup-nodeusage.Expected behavior:
Caching should not be enabled by default in privileged workflows.
Actual behavior:
Caching is enabled by default.