gradle/wrapper-validation-action
1
0
Fork 0
mirror of https://github.com/gradle/wrapper-validation-action synced 2024-11-23 17:22:01 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions

Merge pull request #12 from JLLeitschuh/chore/JLL/remove_company_note

Browse source 
Remove comment about problem being unique to open source
This commit is contained in:
Jonathan Leitschuh 2020-01-31 11:36:54 -05:00 committed by GitHub
commit 17df8817b6
No known key found for this signature in database
GPG key ID: 4AEE18F83AFDEB23
1 changed files with 0 additions and 2 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

2
README.md
View file

@ -24,8 +24,6 @@ Further compounding the issue is that maintainers are most often greeted in thes
A fairly simple social engineering supply chain attack against open source would be contribute a helpful “Updated to Gradle xxx” PR that contains malicious code hidden inside this binary JAR.
A malicious `gradle-wrapper.jar` could execute, download, or install arbitrary code while otherwise behaving like a completely normal `gradle-wrapper.jar`.
This problem is unique to open source and doesn’t normally impact companies with closed source and pre-vetted employees.
## Solution
We have created a simple GitHub Action that can be applied to any GitHub repository.