1
0
Fork 0
mirror of https://code.forgejo.org/forgejo/runner.git synced 2025-09-15 18:57:01 +00:00
Forgejo runner - alpha release, should not be considered secure enough to deploy in production
Find a file
Renovate Bot d2b39167a8
Update github.com/go-viper/mapstructure/v2 (indirect) to v2.4.0 [SECURITY] (#904)
This PR contains the following updates:

| Package | Change | Age | Confidence |
|---|---|---|---|
| [github.com/go-viper/mapstructure/v2](https://github.com/go-viper/mapstructure) | `v2.3.0` -> `v2.4.0` | [![age](https://developer.mend.io/api/mc/badges/age/go/github.com%2fgo-viper%2fmapstructure%2fv2/v2.4.0?slim=true)](https://docs.renovatebot.com/merge-confidence/) | [![confidence](https://developer.mend.io/api/mc/badges/confidence/go/github.com%2fgo-viper%2fmapstructure%2fv2/v2.3.0/v2.4.0?slim=true)](https://docs.renovatebot.com/merge-confidence/) |

---

### go-viper's mapstructure May Leak Sensitive Information in Logs When Processing Malformed Data
[GHSA-2464-8j7c-4cjm](https://github.com/advisories/GHSA-2464-8j7c-4cjm)

<details>
<summary>More information</summary>

#### Details
##### Summary

Use of this library in a security-critical context may result in leaking sensitive information, if used to process sensitive fields.

##### Details

OpenBao (and presumably HashiCorp Vault) have surfaced error messages from `mapstructure` as follows:

98c3a59c04/sdk/framework/field_data.go (L43-L50)

```go
			_, _, err := d.getPrimitive(field, schema)
			if err != nil {
				return fmt.Errorf("error converting input for field %q: %w", field, err)
			}
```

where this calls `mapstructure.WeakDecode(...)`: 98c3a59c04/sdk/framework/field_data.go (L181-L193)

```go

func (d *FieldData) getPrimitive(k string, schema *FieldSchema) (interface{}, bool, error) {
	raw, ok := d.Raw[k]
	if !ok {
		return nil, false, nil
	}

	switch t := schema.Type; t {
	case TypeBool:
		var result bool
		if err := mapstructure.WeakDecode(raw, &result); err != nil {
			return nil, false, err
		}
		return result, true, nil
```

Notably, `WeakDecode(...)` eventually calls one of the decode helpers, which surfaces the original value via `strconv` helpers:

8c61ec1924/mapstructure.go (L720-L727)

8c61ec1924/mapstructure.go (L791-L798)

8c61ec1924/decode_hooks.go (L180)

& more. These are different code paths than are fixed in the previous iteration at https://github.com/go-viper/mapstructure/security/advisories/GHSA-fv92-fjc5-jj9h.

##### PoC

To reproduce with OpenBao:

```
$ podman run --pull=always -p 8300:8300 openbao/openbao:latest server -dev -dev-root-token-id=root -dev-listen-address=0.0.0.0:8300
```

and in a new tab:

```
$ BAO_TOKEN=root BAO_ADDR=http://localhost:8300 bao auth enable userpass
Success! Enabled userpass auth method at: userpass/
$ curl -X PUT -H "X-Vault-Request: true" -H "X-Vault-Token: root" -d '{"ttl":"asdf"}' "http://localhost:8200/v1/auth/userpass/users/asdf"

--> server logs:

2025-06-25T21:32:25.101-0500 [ERROR] core: failed to run existence check: error="error converting input for field \"ttl\": time: invalid duration \"asdf\""
```

##### Impact

This is an information disclosure bug with little mitigation. See https://discuss.hashicorp.com/t/hcsec-2025-09-vault-may-expose-sensitive-information-in-error-logs-when-processing-malformed-data-with-the-kv-v2-plugin/74717 for a previous version. That version was fixed, but this is in the second part of that error message (starting at `'' expected a map, got 'string'` -- when the field type is `string` and a `map` is provided, we see the above information leak -- the previous example had a `map` type field with a `string` value provided).

This was rated 4.5 Medium by HashiCorp in the past iteration.

#### Severity
- CVSS Score: 5.3 / 10 (Medium)
- Vector String: `CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N`

#### References
- [https://github.com/go-viper/mapstructure/security/advisories/GHSA-2464-8j7c-4cjm](https://github.com/go-viper/mapstructure/security/advisories/GHSA-2464-8j7c-4cjm)
- [742921c9ba)
- [https://github.com/go-viper/mapstructure](https://github.com/go-viper/mapstructure)

This data is provided by [OSV](https://osv.dev/vulnerability/GHSA-2464-8j7c-4cjm) and the [GitHub Advisory Database](https://github.com/github/advisory-database) ([CC-BY 4.0](https://github.com/github/advisory-database/blob/main/LICENSE.md)).
</details>

---

### Release Notes

<details>
<summary>go-viper/mapstructure (github.com/go-viper/mapstructure/v2)</summary>

### [`v2.4.0`](https://github.com/go-viper/mapstructure/releases/tag/v2.4.0)

[Compare Source](https://github.com/go-viper/mapstructure/compare/v2.3.0...v2.4.0)

#### What's Changed

- refactor: replace interface{} with any by [@&#8203;sagikazarmark](https://github.com/sagikazarmark) in https://github.com/go-viper/mapstructure/pull/115
- build(deps): bump github/codeql-action from 3.29.0 to 3.29.2 by [@&#8203;dependabot](https://github.com/dependabot)\[bot] in https://github.com/go-viper/mapstructure/pull/114
- Generic tests by [@&#8203;sagikazarmark](https://github.com/sagikazarmark) in https://github.com/go-viper/mapstructure/pull/118
- Fix godoc reference link in README.md by [@&#8203;peczenyj](https://github.com/peczenyj) in https://github.com/go-viper/mapstructure/pull/107
- feat: add StringToTimeLocationHookFunc to convert strings to \*time.Location by [@&#8203;ErfanMomeniii](https://github.com/ErfanMomeniii) in https://github.com/go-viper/mapstructure/pull/117
- feat: add back previous StringToSlice as a weak function by [@&#8203;sagikazarmark](https://github.com/sagikazarmark) in https://github.com/go-viper/mapstructure/pull/119

#### New Contributors

- [@&#8203;ErfanMomeniii](https://github.com/ErfanMomeniii) made their first contribution in https://github.com/go-viper/mapstructure/pull/117

**Full Changelog**: https://github.com/go-viper/mapstructure/compare/v2.3.0...v2.4.0

</details>

---

### Configuration

📅 **Schedule**: Branch creation - "" (UTC), Automerge - Between 12:00 AM and 03:59 AM ( * 0-3 * * * ) (UTC).

🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied.

♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 **Ignore**: Close this PR and you won't be reminded about this update again.

---

 - [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check this box

---

This PR has been generated by [Renovate Bot](https://github.com/renovatebot/renovate).
<!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0MS43Ni4wIiwidXBkYXRlZEluVmVyIjoiNDEuNzYuMCIsInRhcmdldEJyYW5jaCI6Im1haW4iLCJsYWJlbHMiOlsiS2luZC9DaG9yZSJdfQ==-->

<!--start release-notes-assistant-->
<!--URL:https://code.forgejo.org/forgejo/runner-->
- other
  - [PR](https://code.forgejo.org/forgejo/runner/pulls/904): <!--number 904 --><!--line 0 --><!--description VXBkYXRlIGdpdGh1Yi5jb20vZ28tdmlwZXIvbWFwc3RydWN0dXJlL3YyIChpbmRpcmVjdCkgdG8gdjIuNC4wIFtTRUNVUklUWV0=-->Update github.com/go-viper/mapstructure/v2 (indirect) to v2.4.0 [SECURITY]<!--description-->
<!--end release-notes-assistant-->

Reviewed-on: https://code.forgejo.org/forgejo/runner/pulls/904
Reviewed-by: earl-warren <earl-warren@noreply.code.forgejo.org>
Co-authored-by: Renovate Bot <bot@kriese.eu>
Co-committed-by: Renovate Bot <bot@kriese.eu>
2025-08-21 19:44:03 +00:00
.forgejo chore: do not force GOPROXY (#899) 2025-08-21 11:53:48 +00:00
.github/workflows chore: restore GitHub windows build workflow (#815) 2025-08-07 08:56:39 +00:00
act chore: remove TestRunContext_GetGitHubContext (#900) 2025-08-21 11:54:04 +00:00
contrib Restore contrib/forgejo-runner.service (#772) 2025-07-30 22:16:05 +00:00
examples Update dependency forgejo/runner to v9.1.1 (#898) 2025-08-21 07:16:34 +00:00
internal fix: an error from a SKIPPED job does not transform it into a FAILURE (#896) 2025-08-20 22:02:43 +00:00
release-notes feat: add the runner validate subcommand (#757) 2025-07-31 05:37:12 +00:00
testutils feat: add the runner validate subcommand (#757) 2025-07-31 05:37:12 +00:00
.dockerignore [FORGEJO] build forgejo-runner 2023-08-23 14:44:47 +02:00
.editorconfig Add .editorconfig and .gitattributes (#186) 2023-05-13 23:51:22 +08:00
.gitattributes Add .editorconfig and .gitattributes (#186) 2023-05-13 23:51:22 +08:00
.gitignore chore: remove unused code and comments including gitea 2025-07-03 18:58:11 +02:00
.golangci.yml chore: use t.Context for tests, activate usetesting for lint + add t.TempDir and t.Chdir (#844) 2025-08-11 13:21:42 +00:00
Dockerfile Update data.forgejo.org/oci/alpine Docker tag to v3.22 (#616) 2025-06-18 05:43:57 +00:00
go.mod Update github.com/go-viper/mapstructure/v2 (indirect) to v2.4.0 [SECURITY] (#904) 2025-08-21 19:44:03 +00:00
go.sum Update github.com/go-viper/mapstructure/v2 (indirect) to v2.4.0 [SECURITY] (#904) 2025-08-21 19:44:03 +00:00
LICENSE chore: update LICENSE year 2025-07-03 18:58:11 +02:00
main.go chore: to allow the runner to be imported, v9 needs to be in the go module (#777) 2025-07-31 10:35:11 +00:00
Makefile chore: fix .PHONY lint targets (#893) 2025-08-21 11:24:11 +00:00
README.md chore: remove the alpha quality warning, it is secure enough to be used in production (#774) 2025-08-10 20:21:05 +00:00
RELEASE-NOTES.md chore: release notes are now published together with the release (#775) 2025-07-31 08:02:20 +00:00
renovate.json chore: set the Kind/Chore label on dependencies upgrades (#842) 2025-08-11 08:30:33 +00:00

Forgejo Runner

A daemon that connects to a Forgejo instance and runs jobs for continuous integration. The installation and usage instructions are part of the Forgejo documentation.

Reporting bugs

When filing a bug in the issue tracker, it is very helpful to propose a pull request in the end-to-end tests repository that adds a reproducer. It will fail the CI and unambiguously demonstrate that the problem exists. In most cases it is enough to add a workflow (see the echo example). For more complicated cases it is also possible to add a runner config file as well as shell scripts to setup and teardown the test case (see the service example).

Sensitive security-related issues should be reported to security@forgejo.org using encryption.

License

The Forgejo runner source code is distributed under the terms of the following licenses:

Architectures & OS

The Forgejo runner is supported and tested on amd64 and arm64 (binaries and containers) on Operating Systems based on the Linux kernel.

Work may be in progress for other architectures and you can browse the corresponding issues to figure out how they make progress. If you are interested in helping them move forward, open an issue. The most challenging part is to setup and maintain a native runner long term. Once it is supported by Forgejo, the runner is expected to be available 24/7 which can be challenging. Otherwise debugging any architecture specific problem won't be possible.

Hacking

The Forgejo runner is a dependency of the setup-forgejo action. See the full dependency graph for a global view.

Building

  • Install Go and make(1)
  • make build

The test workflow is a full example that builds the binary, runs the tests and launches the runner binary against a live Forgejo instance.

Generate mocks

  • make deps-tools
  • make generate

If there are changes, commit them to the repository.

Local debug

The repositories are checked out in the same directory:

Install dependencies

The dependencies are installed manually or with:

setup-forgejo/forgejo-dependencies.sh

Build the Forgejo runner

cd runner ; rm -f forgejo-runner ; make forgejo-runner

Launch Forgejo and the runner

A Forgejo instance is launched with:

cd setup-forgejo
./forgejo.sh setup
firefox $(cat forgejo-url)

The user is root with password admin1234. The runner is registered with:

cd setup-forgejo
docker exec --user 1000 forgejo forgejo actions generate-runner-token > forgejo-runner-token
../runner/forgejo-runner register --no-interactive --instance "$(cat forgejo-url)" --name runner --token $(cat forgejo-runner-token) --labels docker:docker://node:22-bookworm,self-hosted:host,lxc:lxc://debian:bookworm

And launched with:

cd setup-forgejo ; ../runner/forgejo-runner --config runner-config.yml daemon

Note that the runner-config.yml is required in that particular case to configure the network in bridge mode, otherwise the runner will create a network that cannot reach the forgejo instance.

Try a sample workflow

From the Forgejo web interface, create a repository and add the following to .forgejo/workflows/try.yaml. It will launch the job and the result can be observed from the actions tab.

on: [push]
jobs:
  ls:
    runs-on: docker
    steps:
      - uses: actions/checkout@v4
      - run: |
          ls ${{ github.workspace }}