BehindTheBarrier@programming.devtoProgramming@programming.dev•Malicious code injection by compromised pull request branch namesEnglish
8·
9 days agoI never considered branch names to be a vector, but in hindsight it makes total sense when put into a workflow like that.
What possibly surprised me even more, was that branch names weren’t limited to basic characters or at least no special signs. I obviously see the case for all the extended characters outside the latin alphabet, such as Chinese characters, but I totally expected restrictions on special symbols like "
, '
, /
, \
, ;
, etc.
Made my own (windows only) to learn programming. Primarily because nothing beats Ctrl-C, Alt-Tab, Ctrl-V, Enter, Alt-Tab to download something. Then profiles, textfile with link support, and parallel downloads since some sites rate limit downloads.
Somewhat crude (don’t ask me how the profile are stored behind the scenes, it’s a mess)
https://github.com/Thomasedv/Grabber