step-security/harden-runner
1
0
Fork 0
mirror of synced 2026-06-05 15:08:19 +00:00
Code Issues Projects Releases Packages Wiki Activity

chore: clean the code

Browse source
This commit is contained in:
h0x0er 2024-10-24 13:46:05 +05:30
commit 6c39b84661
No known key found for this signature in database
GPG key ID: 191FD2B45D961149
6 changed files with 75 additions and 107 deletions
Download patch file Download diff file Expand all files Collapse all files

17
dist/post/index.js vendored
View file

@ -3013,12 +3013,9 @@ function isDocker() {
return isDockerCached;
}
// EXTERNAL MODULE: external "path"
var external_path_ = __nccwpck_require__(622);
;// CONCATENATED MODULE: ./src/arc-runner.ts
function isArcRunner() {
const runnerUserAgent = process.env["GITHUB_ACTIONS_RUNNER_EXTRA_USER_AGENT"];
let isARC = false;
@ -3034,20 +3031,13 @@ function isSecondaryPod() {
const workDir = "/__w";
return external_fs_.existsSync(workDir);
}
function getRunnerTempDir() {
const isTest = process.env["isTest"];
if (isTest === "1") {
return "/tmp";
}
return process.env["RUNNER_TEMP"] || "/tmp";
}
function sendAllowedEndpoints(endpoints) {
const allowedEndpoints = endpoints.split(" "); // endpoints are space separated
for (const endpoint of allowedEndpoints) {
if (endpoint) {
let encodedEndpoint = Buffer.from(endpoint).toString("base64");
let fileName = path.join(getRunnerTempDir(), `step_policy_endpoint_${encodedEndpoint}`);
echo(fileName);
let endpointPolicyStr = `step_policy_endpoint_${encodedEndpoint}`;
echo(endpointPolicyStr);
}
}
if (allowedEndpoints.length > 0) {
@ -3056,8 +3046,7 @@ function sendAllowedEndpoints(endpoints) {
}
function applyPolicy(count) {
let applyPolicyStr = `step_policy_apply_${count}`;
let fileName = path.join(getRunnerTempDir(), applyPolicyStr);
echo(fileName);
echo(applyPolicyStr);
}
function echo(content) {
cp.execFileSync("echo", [content]);

2
dist/post/index.js.map vendored
View file

File diff suppressed because one or more lines are too long

128
dist/pre/index.js vendored
View file

@ -20024,11 +20024,12 @@ exports.setSpanContext = setSpanContext;
"use strict";
Object.defineProperty(exports, "__esModule", ({ value: true }));
var abortController = __nccwpck_require__(2557);
var crypto = __nccwpck_require__(6417);
// Copyright (c) Microsoft Corporation.
// Licensed under the MIT license.
/**
* Creates an abortable promise.
* @param buildPromise - A function that takes the resolve and reject functions as parameters.
@ -20069,7 +20070,6 @@ function createAbortablePromise(buildPromise, options) {
}
// Copyright (c) Microsoft Corporation.
// Licensed under the MIT license.
const StandardAbortMessage = "The delay was aborted.";
/**
* A wrapper for setTimeout that resolves a promise after timeInMs milliseconds.
@ -20089,27 +20089,6 @@ function delay(timeInMs, options) {
});
}
// Copyright (c) Microsoft Corporation.
// Licensed under the MIT license.
/**
* promise.race() wrapper that aborts rest of promises as soon as the first promise settles.
*/
async function cancelablePromiseRace(abortablePromiseBuilders, options) {
var _a, _b;
const aborter = new abortController.AbortController();
function abortHandler() {
aborter.abort();
}
(_a = options === null || options === void 0 ? void 0 : options.abortSignal) === null || _a === void 0 ? void 0 : _a.addEventListener("abort", abortHandler);
try {
return await Promise.race(abortablePromiseBuilders.map((p) => p({ abortSignal: aborter.signal })));
}
finally {
aborter.abort();
(_b = options === null || options === void 0 ? void 0 : options.abortSignal) === null || _b === void 0 ? void 0 : _b.removeEventListener("abort", abortHandler);
}
}
// Copyright (c) Microsoft Corporation.
// Licensed under the MIT license.
/**
@ -20146,7 +20125,6 @@ function isObject(input) {
}
// Copyright (c) Microsoft Corporation.
// Licensed under the MIT license.
/**
* Typeguard for an error object shape (has name and message)
* @param e - Something caught by a catch clause.
@ -20187,7 +20165,6 @@ function getErrorMessage(e) {
}
// Copyright (c) Microsoft Corporation.
// Licensed under the MIT license.
/**
* Generates a SHA-256 HMAC signature.
* @param key - The HMAC key represented as a base64 string, used to generate the cryptographic HMAC hash.
@ -20312,20 +20289,16 @@ const isWebWorker = typeof self === "object" &&
(((_a = self.constructor) === null || _a === void 0 ? void 0 : _a.name) === "DedicatedWorkerGlobalScope" ||
((_b = self.constructor) === null || _b === void 0 ? void 0 : _b.name) === "ServiceWorkerGlobalScope" ||
((_c = self.constructor) === null || _c === void 0 ? void 0 : _c.name) === "SharedWorkerGlobalScope");
/**
* A constant that indicates whether the environment the code is running is Node.JS.
*/
const isNode = typeof process !== "undefined" && Boolean(process.version) && Boolean((_d = process.versions) === null || _d === void 0 ? void 0 : _d.node);
/**
* A constant that indicates whether the environment the code is running is Deno.
*/
const isDeno = typeof Deno !== "undefined" &&
typeof Deno.version !== "undefined" &&
typeof Deno.version.deno !== "undefined";
/**
* A constant that indicates whether the environment the code is running is Node.JS.
*/
const isNode = typeof process !== "undefined" &&
Boolean(process.version) &&
Boolean((_d = process.versions) === null || _d === void 0 ? void 0 : _d.node) &&
// Deno thought it was a good idea to spoof process.versions.node, see https://deno.land/std@0.177.0/node/process.ts?s=versions
!isDeno;
/**
* A constant that indicates whether the environment the code is running is Bun.sh.
*/
@ -20345,7 +20318,14 @@ const isReactNative = typeof navigator !== "undefined" && (navigator === null ||
* @returns a string of the encoded string
*/
function uint8ArrayToString(bytes, format) {
return Buffer.from(bytes).toString(format);
switch (format) {
case "utf-8":
return uint8ArrayToUtf8String(bytes);
case "base64":
return uint8ArrayToBase64(bytes);
case "base64url":
return uint8ArrayToBase64Url(bytes);
}
}
/**
* The helper that transforms string to specific character encoded bytes array.
@ -20354,10 +20334,58 @@ function uint8ArrayToString(bytes, format) {
* @returns a uint8array
*/
function stringToUint8Array(value, format) {
return Buffer.from(value, format);
switch (format) {
case "utf-8":
return utf8StringToUint8Array(value);
case "base64":
return base64ToUint8Array(value);
case "base64url":
return base64UrlToUint8Array(value);
}
}
/**
* Decodes a Uint8Array into a Base64 string.
* @internal
*/
function uint8ArrayToBase64(bytes) {
return Buffer.from(bytes).toString("base64");
}
/**
* Decodes a Uint8Array into a Base64Url string.
* @internal
*/
function uint8ArrayToBase64Url(bytes) {
return Buffer.from(bytes).toString("base64url");
}
/**
* Decodes a Uint8Array into a javascript string.
* @internal
*/
function uint8ArrayToUtf8String(bytes) {
return Buffer.from(bytes).toString("utf-8");
}
/**
* Encodes a JavaScript string into a Uint8Array.
* @internal
*/
function utf8StringToUint8Array(value) {
return Buffer.from(value);
}
/**
* Encodes a Base64 string into a Uint8Array.
* @internal
*/
function base64ToUint8Array(value) {
return Buffer.from(value, "base64");
}
/**
* Encodes a Base64Url string into a Uint8Array.
* @internal
*/
function base64UrlToUint8Array(value) {
return Buffer.from(value, "base64url");
}
exports.cancelablePromiseRace = cancelablePromiseRace;
exports.computeSha256Hash = computeSha256Hash;
exports.computeSha256Hmac = computeSha256Hmac;
exports.createAbortablePromise = createAbortablePromise;
@ -71177,18 +71205,6 @@ module.exports = require("zlib");
/******/ }
/******/
/************************************************************************/
/******/ /* webpack/runtime/compat get default export */
/******/ (() => {
/******/ // getDefaultExport function for compatibility with non-harmony modules
/******/ __nccwpck_require__.n = (module) => {
/******/ var getter = module && module.__esModule ?
/******/ () => (module['default']) :
/******/ () => (module);
/******/ __nccwpck_require__.d(getter, { a: getter });
/******/ return getter;
/******/ };
/******/ })();
/******/
/******/ /* webpack/runtime/define property getters */
/******/ (() => {
/******/ // define getter functions for harmony exports
@ -71244,7 +71260,6 @@ var external_fs_ = __nccwpck_require__(5747);
var lib = __nccwpck_require__(6255);
// EXTERNAL MODULE: external "path"
var external_path_ = __nccwpck_require__(5622);
var external_path_default = /*#__PURE__*/__nccwpck_require__.n(external_path_);
// EXTERNAL MODULE: ./node_modules/uuid/dist/index.js
var dist = __nccwpck_require__(5840);
;// CONCATENATED MODULE: ./node_modules/uuid/wrapper.mjs
@ -71533,7 +71548,6 @@ var cacheUtils = __nccwpck_require__(1518);
;// CONCATENATED MODULE: ./src/arc-runner.ts
function isArcRunner() {
const runnerUserAgent = process.env["GITHUB_ACTIONS_RUNNER_EXTRA_USER_AGENT"];
let isARC = false;
@ -71549,20 +71563,13 @@ function isSecondaryPod() {
const workDir = "/__w";
return external_fs_.existsSync(workDir);
}
function getRunnerTempDir() {
const isTest = process.env["isTest"];
if (isTest === "1") {
return "/tmp";
}
return process.env["RUNNER_TEMP"] || "/tmp";
}
function sendAllowedEndpoints(endpoints) {
const allowedEndpoints = endpoints.split(" "); // endpoints are space separated
for (const endpoint of allowedEndpoints) {
if (endpoint) {
let encodedEndpoint = Buffer.from(endpoint).toString("base64");
let fileName = external_path_default().join(getRunnerTempDir(), `step_policy_endpoint_${encodedEndpoint}`);
echo(fileName);
let endpointPolicyStr = `step_policy_endpoint_${encodedEndpoint}`;
echo(endpointPolicyStr);
}
}
if (allowedEndpoints.length > 0) {
@ -71571,8 +71578,7 @@ function sendAllowedEndpoints(endpoints) {
}
function applyPolicy(count) {
let applyPolicyStr = `step_policy_apply_${count}`;
let fileName = external_path_default().join(getRunnerTempDir(), applyPolicyStr);
echo(fileName);
echo(applyPolicyStr);
}
function echo(content) {
external_child_process_.execFileSync("echo", [content]);

2
dist/pre/index.js.map vendored
View file

File diff suppressed because one or more lines are too long

11
src/arc-runner.test.ts
View file

@ -7,14 +7,3 @@ it("should correctly recognize arc based runner", async () => {
let isArc: boolean = await isArcRunner();
expect(isArc).toBe(true);
});
it("should write endpoint files", () => {
process.env["isTest"] = "1";
let allowed_endpoints = [
"github.com:443",
"*.google.com:443",
"youtube.com",
].join(" ");
sendAllowedEndpoints(allowed_endpoints);
});

22
src/arc-runner.ts
View file

@ -21,28 +21,14 @@ function isSecondaryPod(): boolean {
return fs.existsSync(workDir);
}
function getRunnerTempDir(): string {
const isTest = process.env["isTest"];
if (isTest === "1") {
return "/tmp";
}
return process.env["RUNNER_TEMP"] || "/tmp";
}
export function sendAllowedEndpoints(endpoints: string): void {
const allowedEndpoints = endpoints.split(" "); // endpoints are space separated
for (const endpoint of allowedEndpoints) {
if (endpoint) {
let encodedEndpoint = Buffer.from(endpoint).toString("base64");
let fileName = path.join(
getRunnerTempDir(),
`step_policy_endpoint_${encodedEndpoint}`
);
echo(fileName);
let endpointPolicyStr = `step_policy_endpoint_${encodedEndpoint}`;
echo(endpointPolicyStr);
}
}
@ -53,9 +39,7 @@ export function sendAllowedEndpoints(endpoints: string): void {
function applyPolicy(count: number): void {
let applyPolicyStr = `step_policy_apply_${count}`;
let fileName = path.join(getRunnerTempDir(), applyPolicyStr);
echo(fileName);
echo(applyPolicyStr);
}
function echo(content: string) {