gradle/wrapper-validation-action
1
0
Fork 0
mirror of https://github.com/gradle/wrapper-validation-action synced 2024-11-27 10:42:03 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions

Remove comment about problem being unique to open source

Browse source
This commit is contained in:
Jonathan Leitschuh 2020-01-30 12:37:07 -05:00
parent 6651bb31dd
commit 025bdee66a
No known key found for this signature in database
GPG key ID: 3501A7427721B061
1 changed files with 0 additions and 2 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

2
README.md
View file

@ -24,8 +24,6 @@ Further compounding the issue is that maintainers are most often greeted in thes
A fairly simple social engineering supply chain attack against open source would be contribute a helpful “Updated to Gradle xxx” PR that contains malicious code hidden inside this binary JAR. A fairly simple social engineering supply chain attack against open source would be contribute a helpful “Updated to Gradle xxx” PR that contains malicious code hidden inside this binary JAR.
A malicious `gradle-wrapper.jar` could execute, download, or install arbitrary code while otherwise behaving like a completely normal `gradle-wrapper.jar`. A malicious `gradle-wrapper.jar` could execute, download, or install arbitrary code while otherwise behaving like a completely normal `gradle-wrapper.jar`.
This problem is unique to open source and doesn’t normally impact companies with closed source and pre-vetted employees.
## Solution ## Solution
We have created a simple GitHub Action that can be applied to any GitHub repository. We have created a simple GitHub Action that can be applied to any GitHub repository.