Harden Explore triage writer trust boundaries

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

Copilot-Session: 512eb347-ec89-4250-8bf1-87048974b01d

Author: mrecachinas

.github/workflows/explore-triage-commenter-writer.yml

@@ -27,18 +27,85 @@ jobs:
           GH_TOKEN: ${{ github.token }}
           REPOSITORY: ${{ github.repository }}
           RUN_ID: ${{ github.event.workflow_run.id }}
+          MAX_ARTIFACT_BYTES: 1048576
+          MAX_JSON_BYTES: 131072
         run: |
           set -euo pipefail
           mkdir -p "$RUNNER_TEMP/explore-triage"
-          artifact_id="$(gh api "repos/$REPOSITORY/actions/runs/$RUN_ID/artifacts" \
-            --jq '.artifacts[] | select(.name == "explore-triage-comment" and .expired == false) | .id' | head -n 1)"
-          if [ -z "$artifact_id" ]; then
+          artifact_rows="$(
+            gh api --paginate "repos/$REPOSITORY/actions/runs/$RUN_ID/artifacts" \
+              --jq '.artifacts[] | select(.name == "explore-triage-comment" and .expired == false) | [.id, .size_in_bytes] | @tsv'
+          )"
+          artifacts=()
+          if [ -n "$artifact_rows" ]; then
+            mapfile -t artifacts <<< "$artifact_rows"
+          fi
+          if (( ${#artifacts[@]} == 0 )); then
             echo "No explore triage artifact found for run $RUN_ID"
             echo "found=false" >> "$GITHUB_OUTPUT"
             exit 0
           fi
-          gh api "repos/$REPOSITORY/actions/artifacts/$artifact_id/zip" > "$RUNNER_TEMP/explore-triage/artifact.zip"
-          unzip -p "$RUNNER_TEMP/explore-triage/artifact.zip" explore-triage-comment.json > "$RUNNER_TEMP/explore-triage/comment.json"
+          if (( ${#artifacts[@]} != 1 )); then
+            echo "Expected exactly one explore triage artifact, found ${#artifacts[@]}" >&2
+            exit 1
+          fi
+
+          IFS=$'\t' read -r artifact_id artifact_size <<< "${artifacts[0]}"
+          if ! [[ "$artifact_id" =~ ^[0-9]+$ && "$artifact_size" =~ ^[0-9]+$ ]]; then
+            echo "Artifact metadata is invalid" >&2
+            exit 1
+          fi
+          if (( artifact_size == 0 || artifact_size > MAX_ARTIFACT_BYTES )); then
+            echo "Artifact archive size $artifact_size is outside the allowed range" >&2
+            exit 1
+          fi
+
+          artifact_zip="$RUNNER_TEMP/explore-triage/artifact.zip"
+          comment_json="$RUNNER_TEMP/explore-triage/comment.json"
+          gh api "repos/$REPOSITORY/actions/artifacts/$artifact_id/zip" > "$artifact_zip"
+
+          actual_artifact_size="$(stat -c '%s' "$artifact_zip")"
+          if ! [[ "$actual_artifact_size" =~ ^[0-9]+$ ]] ||
+             (( actual_artifact_size == 0 || actual_artifact_size > MAX_ARTIFACT_BYTES )); then
+            echo "Downloaded artifact archive size $actual_artifact_size is outside the allowed range" >&2
+            exit 1
+          fi
+
+          ARTIFACT_ZIP="$artifact_zip" COMMENT_JSON="$comment_json" python3 - <<'PY'
+          import os
+          import zipfile
+
+          archive_path = os.environ["ARTIFACT_ZIP"]
+          output_path = os.environ["COMMENT_JSON"]
+          max_json_bytes = int(os.environ["MAX_JSON_BYTES"])
+          expected_name = "explore-triage-comment.json"
+
+          with zipfile.ZipFile(archive_path) as archive:
+              matches = [entry for entry in archive.infolist() if entry.filename == expected_name]
+              if len(matches) != 1:
+                  raise ValueError(f"Expected exactly one {expected_name} entry, found {len(matches)}")
+
+              entry = matches[0]
+              if entry.is_dir() or entry.flag_bits & 0x1:
+                  raise ValueError("Artifact JSON entry must be an unencrypted regular file")
+              if entry.file_size == 0 or entry.file_size > max_json_bytes:
+                  raise ValueError(
+                      f"Artifact JSON entry size {entry.file_size} is outside the allowed range"
+                  )
+
+              total = 0
+              with archive.open(entry) as source, open(output_path, "xb") as destination:
+                  while chunk := source.read(65536):
+                      total += len(chunk)
+                      if total > max_json_bytes:
+                          raise ValueError("Artifact JSON exceeded the allowed size while extracting")
+                      destination.write(chunk)
+
+              if total != entry.file_size:
+                  raise ValueError(
+                      f"Extracted JSON size {total} did not match declared size {entry.file_size}"
+                  )
+          PY
           echo "found=true" >> "$GITHUB_OUTPUT"
 
       - name: Upsert sticky comment
@@ -59,22 +126,38 @@ jobs:
 
             const data = JSON.parse(fs.readFileSync(process.env.COMMENT_DATA_PATH, 'utf8'));
             validateIdentity(data);
+            validatePayload(data);
 
             const runHeadSha = await getWorkflowRunHeadSha(run);
             if (!/^[0-9a-f]{40}$/i.test(runHeadSha)) {
               throw new Error(`Workflow run head SHA is invalid: ${runHeadSha}`);
             }
 
+            const associatedPrNumber = await getAssociatedPullRequestNumber(run, runHeadSha);
+            if (associatedPrNumber === null) return;
+            if (data.prNumber !== associatedPrNumber) {
+              core.info(`Artifact PR #${data.prNumber} is not the PR associated with workflow run ${run.id}; skipping.`);
+              return;
+            }
+
             const { data: pr } = await github.rest.pulls.get({
               owner,
               repo,
-              pull_number: data.prNumber,
+              pull_number: associatedPrNumber,
             });
 
             if (pr.head.sha !== runHeadSha) {
               core.info(`PR #${pr.number} head ${pr.head.sha} does not match workflow run head ${runHeadSha}; skipping.`);
               return;
             }
+            if (run.head_repository && pr.head.repo && pr.head.repo.full_name !== run.head_repository.full_name) {
+              core.info(`PR #${pr.number} head repository does not match the workflow run; skipping.`);
+              return;
+            }
+            if (run.head_branch && pr.head.ref !== run.head_branch) {
+              core.info(`PR #${pr.number} head branch does not match the workflow run; skipping.`);
+              return;
+            }
             if (pr.base.repo.full_name !== expectedRepo) {
               throw new Error(`Unexpected base repo: ${pr.base.repo.full_name}`);
             }
@@ -91,8 +174,10 @@ jobs:
               return;
             }
 
-            validatePayload(data);
             const body = renderComment(data);
+            if (Buffer.byteLength(body, 'utf8') > 60000) {
+              throw new Error('Rendered triage comment exceeds the allowed size.');
+            }
 
             const comments = await github.paginate(github.rest.issues.listComments, {
               owner,
@@ -135,14 +220,57 @@ jobs:
               return workflowRun.head_sha;
             }
 
+            async function getAssociatedPullRequestNumber(run, runHeadSha) {
+              const runPullRequests = Array.isArray(run.pull_requests) ? run.pull_requests : [];
+              if (runPullRequests.length > 0) {
+                const associatedNumbers = runPullRequests
+                  .map(pull => pull && pull.number)
+                  .filter(number => Number.isSafeInteger(number) && number > 0);
+                if (!associatedNumbers.includes(data.prNumber)) {
+                  core.info(`Artifact PR #${data.prNumber} is not in the workflow run pull request association; skipping.`);
+                  return null;
+                }
+                return data.prNumber;
+              }
+
+              const headRepo = run.head_repository;
+              const headBranch = run.head_branch;
+              const headOwner = headRepo && headRepo.owner && headRepo.owner.login;
+              if (!headRepo || typeof headRepo.full_name !== 'string' ||
+                  typeof headOwner !== 'string' || typeof headBranch !== 'string' ||
+                  headOwner.length === 0 || headBranch.length === 0) {
+                throw new Error('Workflow run is missing the trusted head repository or branch association.');
+              }
+
+              const candidates = await github.paginate(github.rest.pulls.list, {
+                owner,
+                repo,
+                state: 'all',
+                head: `${headOwner}:${headBranch}`,
+                per_page: 100,
+              });
+              const matches = candidates.filter(pull =>
+                Number.isSafeInteger(pull.number) &&
+                pull.head && pull.head.sha === runHeadSha &&
+                pull.head.ref === headBranch &&
+                pull.head.repo && pull.head.repo.full_name === headRepo.full_name &&
+                pull.base && pull.base.repo && pull.base.repo.full_name === expectedRepo
+              );
+              if (matches.length !== 1) {
+                core.warning(`Could not uniquely associate workflow run ${run.id} with a pull request; found ${matches.length} matches.`);
+                return null;
+              }
+              return matches[0].number;
+            }
+
             function validateIdentity(data) {
               if (!data || data.schema !== 'explore-triage-comment/v1') {
                 throw new Error('Unexpected artifact schema.');
               }
               if (data.owner !== owner || data.repo !== repo) {
                 throw new Error(`Artifact repo mismatch: ${data.owner}/${data.repo}`);
               }
-              if (!Number.isInteger(data.prNumber) || data.prNumber <= 0) {
+              if (!Number.isSafeInteger(data.prNumber) || data.prNumber <= 0) {
                 throw new Error(`Artifact PR number is invalid: ${data.prNumber}`);
               }
               if (data.baseRepoFullName !== `${owner}/${repo}`) {
@@ -151,6 +279,9 @@ jobs:
               if (!/^[0-9a-f]{40}$/i.test(data.headSha)) {
                 throw new Error('Artifact head SHA is invalid.');
               }
+              if (typeof data.hasChanges !== 'boolean') {
+                throw new Error('Artifact hasChanges flag is invalid.');
+              }
             }
 
             function validatePayload(data) {
@@ -161,16 +292,27 @@ jobs:
                 throw new Error('Artifact contains too many topic or collection entries.');
               }
               for (const topic of data.topics) {
+                if (!topic || typeof topic !== 'object') {
+                  throw new Error('Invalid topic entry.');
+                }
                 validateSlug(topic.slug);
-                if (topic.count !== null && (!Number.isInteger(topic.count) || topic.count < 0)) {
+                if (topic.count !== null && (!Number.isSafeInteger(topic.count) || topic.count < 0)) {
                   throw new Error(`Invalid topic count for ${topic.slug}.`);
                 }
               }
               for (const collection of data.collections) {
+                if (!collection || typeof collection !== 'object') {
+                  throw new Error('Invalid collection entry.');
+                }
                 validateSlug(collection.slug);
                 if (!['ok', 'not-found', 'error'].includes(collection.readStatus)) {
                   throw new Error(`Invalid read status for ${collection.slug}.`);
                 }
+                validateOptionalStatusToken(
+                  collection.errorStatus,
+                  `collection ${collection.slug}`,
+                  collection.readStatus !== 'ok'
+                );
                 if (!Array.isArray(collection.items) || collection.items.length > 500) {
                   throw new Error(`Invalid item list for ${collection.slug}.`);
                 }
@@ -185,11 +327,11 @@ jobs:
             }
 
             function validateItem(item) {
-              if (!item || typeof item.name !== 'string' || item.name.length > 140) {
+              if (!item || typeof item.name !== 'string' || item.name.length === 0 || item.name.length > 140) {
                 throw new Error('Invalid item name.');
               }
               if (item.valid === false) {
-                if (!/^[A-Za-z0-9._/-]+$/.test(item.name)) {
+                if (/[\u0000-\u001f\u007f-\u009f\u2028\u2029]/u.test(item.name)) {
                   throw new Error(`Unsafe invalid item token: ${item.name}`);
                 }
                 return;
@@ -200,11 +342,16 @@ jobs:
               if (!['ok', 'not-found', 'error'].includes(item.lookupStatus)) {
                 throw new Error(`Invalid lookup status for ${item.name}.`);
               }
+              validateOptionalStatusToken(
+                item.errorStatus,
+                `item ${item.name}`,
+                item.lookupStatus !== 'ok'
+              );
               if (item.lookupStatus === 'ok') {
-                if (!Number.isInteger(item.stars) || item.stars < 0) throw new Error(`Invalid stars for ${item.name}.`);
+                if (!Number.isSafeInteger(item.stars) || item.stars < 0) throw new Error(`Invalid stars for ${item.name}.`);
                 if (item.pushed !== null && !/^\d{4}-\d{2}-\d{2}$/.test(item.pushed)) throw new Error(`Invalid pushed date for ${item.name}.`);
-                if (typeof item.ownerType !== 'string' || !/^[A-Za-z]+$/.test(item.ownerType)) throw new Error(`Invalid owner type for ${item.name}.`);
-                if (!Array.isArray(item.notes)) throw new Error(`Invalid notes for ${item.name}.`);
+                if (typeof item.ownerType !== 'string' || !/^[A-Za-z]{1,32}$/.test(item.ownerType)) throw new Error(`Invalid owner type for ${item.name}.`);
+                if (!Array.isArray(item.notes) || item.notes.length > 3) throw new Error(`Invalid notes for ${item.name}.`);
                 for (const note of item.notes) {
                   if (!['possible-self-submission', 'archived', 'disabled'].includes(note)) {
                     throw new Error(`Invalid note for ${item.name}: ${note}`);
@@ -213,6 +360,16 @@ jobs:
               }
             }
 
+            function validateOptionalStatusToken(value, label, required) {
+              if (value === null || value === undefined) {
+                if (required) throw new Error(`Missing error status for ${label}.`);
+                return;
+              }
+              if (typeof value !== 'string' || !/^[A-Za-z0-9_-]{1,32}$/.test(value)) {
+                throw new Error(`Invalid error status for ${label}.`);
+              }
+            }
+
             function renderComment(data) {
               const sections = [];