[Security] Fix GraphQL query to get a collaborator's permission

[0xn3va]

I am terribly sorry for opening a public pull request with the fix for this vulnerability. I tried to reach out to you multiple times via X(Twitter), email from https://peterevans.dev/, and LinkedIn but didn't hear back from you. Plus, there is no security policy, so the only option left is opening a pull request.

The action uses the following GraphQL query to get the permissions of a user who triggered the action:

  async getActorPermission(repo: Repository, actor: string): Promise<string> {
    const query = `query CollaboratorPermission($owner: String!, $repo: String!, $collaborator: String) {
      repository(owner:$owner, name:$repo) {
        collaborators(query: $collaborator) {
          edges {
            permission
          }
        }
      }
    }`

The problem is that the $collaborator variable is passed to the query parameter which implements the fuzzy search. In other words, you can use an outside user with a username close to a maintainer username to bypass the permissions validation.

For example, the query above will return the ADMIN permission with the following variables:

• owner: peter-evans
• name: slash-command-dispatch
• collaborator: eter-evans (note there is no the first letter p)

So, it means that an attacker can find users with required permissions in a target repository, create a user with a close name (like eter-evans), and bypass the permissions validation using that user.

To avoid this behaviour, the login parameter must be used instead of query.

[peter-evans]

Hi @0xn3va

Thank you for raising this PR! Apologies for missing your attempts to contact me about this. I vaguely recall seeing something, but I get a lot of random email and messages and sometimes it's not easy to figure out what is genuine and what is spam. Thank you for your effort to get this fixed, I do appreciate it.

I've released the fix as v3.0.2 / v3.

[frederikb]

Just as a heads-up for anyone running into this error:

Error: Request failed due to following response errors:
 - Field 'collaborators' doesn't accept argument 'login'
 - Variable $collaborator is declared by CollaboratorPermission but not used

v3 of this action now requires GitHub Enterprise Server >= 3.9.

Earlier versions do not expose the login field on collaborators as confirmed by comparing the GraphQL schemas:

• https://docs.github.com/public/ghes-3.8/schema.docs-enterprise.graphql
• https://docs.github.com/public/ghes-3.9/schema.docs-enterprise.graphql