Skip to content

canary: v0 .taskcluster.yml scope PoC (authorized HackerOne research) #188

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
0xoroot wants to merge 6 commits into
base: main
Choose a base branch
from
+2 −283
Open

canary: v0 .taskcluster.yml scope PoC (authorized HackerOne research) #188

Changes from all commits
Commits
Show all changes
6 commits
Select commit Hold shift + click to select a range
af6025d
canary: v0 .taskcluster.yml scope PoC (authorized HackerOne research)
0xoroot Jul 7, 2026
e45b6bc
probe: restore standard v1 .taskcluster.yml (reachability test, autho…
0xoroot Jul 7, 2026
b0f166f
poc: v0 scope-escalation (authorized HackerOne research)
0xoroot Jul 7, 2026
bd7abf0
poc: metadata.source javascript: XSS (authorized HackerOne research)
0xoroot Jul 7, 2026
c1861ad
poc2 minimal js source
0xoroot Jul 7, 2026
a5bcf87
revert to benign (poc concluded)
0xoroot Jul 7, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
285 changes: 2 additions & 283 deletions .taskcluster.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,285 +1,4 @@
# yamllint disable rule:line-length
# This file is rendered via JSON-e by
# - github events - https://github.com/taskcluster/taskcluster/tree/main/services/github
# - cron tasks - https://hg.mozilla.org/ci/ci-admin/file/default/build-decision/
# - action tasks - taskcluster/taskgraph/actions/registry.py
---
version: 1
reporting: checks-v1
policy:
pullRequests: public_restricted
hooks:
- name: lint/pre-commit-v1
tasks:
- $let:
trustDomain: "mozilla"
ownerEmail:
$switch:
'tasks_for == "github-push"': '${event.pusher.email}'
'tasks_for == "github-release"': 'release+simple-github-ci@mozilla.com'
'tasks_for[:19] == "github-pull-request"': '${event.pull_request.user.login}@users.noreply.github.com'
'tasks_for in ["cron", "action"]': '${tasks_for}@noreply.mozilla.org'
baseRepoUrl:
$switch:
'tasks_for[:19] == "github-pull-request"': '${event.pull_request.base.repo.html_url}'
'tasks_for in ["cron", "action"]': '${repository.url}'
$default: '${event.repository.html_url}'
repoUrl:
$switch:
'tasks_for[:19] == "github-pull-request"': '${event.pull_request.head.repo.html_url}'
'tasks_for in ["cron", "action"]': '${repository.url}'
$default: '${event.repository.html_url}'
project:
$switch:
'tasks_for in ["github-push", "github-release"]': '${event.repository.name}'
'tasks_for[:19] == "github-pull-request"': '${event.pull_request.base.repo.name}'
'tasks_for in ["cron", "action"]': '${repository.project}'
head_branch:
$switch:
'tasks_for[:19] == "github-pull-request"': ${event.pull_request.head.ref}
'tasks_for == "github-push"': ${event.ref}
'tasks_for == "github-release"': '${event.release.target_commitish}'
'tasks_for in ["action", "cron"]': '${push.branch}'
base_ref:
$switch:
'tasks_for[:19] == "github-pull-request"': ${event.pull_request.base.ref}
'tasks_for == "github-push" && event.base_ref': ${event.base_ref}
'tasks_for in ["github-push", "github-release"]': ''
'tasks_for in ["cron", "action"]': '${push.branch}'
head_ref:
$switch:
'tasks_for[:19] == "github-pull-request"': ${event.pull_request.head.ref}
'tasks_for == "github-push"': ${event.ref}
'tasks_for in ["cron", "action"]': '${push.branch}'
'tasks_for == "github-release"': ${event.release.tag_name}
base_sha:
$switch:
'tasks_for == "github-push"': '${event.before}'
'tasks_for == "github-release"': '${event.release.target_commitish}'
'tasks_for[:19] == "github-pull-request"': '${event.pull_request.base.sha}'
'tasks_for in ["cron", "action"]': '${push.revision}'
head_sha:
$switch:
'tasks_for == "github-push"': '${event.after}'
'tasks_for == "github-release"': '${event.release.tag_name}'
'tasks_for[:19] == "github-pull-request"': '${event.pull_request.head.sha}'
'tasks_for in ["cron", "action"]': '${push.revision}'
ownTaskId:
$switch:
'"github" in tasks_for': {$eval: as_slugid("decision_task")}
'tasks_for in ["cron", "action"]': '${ownTaskId}'
pullRequestAction:
$switch:
'tasks_for[:19] == "github-pull-request"': ${event.action}
$default: 'UNDEFINED'
isPullRequest:
$eval: 'tasks_for[:19] == "github-pull-request"'
in:
$let:
short_base_ref:
$if: 'base_ref[:11] == "refs/heads/"'
then: {$eval: 'base_ref[11:]'}
else: ${base_ref}

short_head_ref:
$if: 'head_ref[:11] == "refs/heads/"'
then: {$eval: 'head_ref[11:]'}
else: ${head_ref}
level: 1
in:
$if: >
tasks_for in ["action", "cron", "github-push"]
|| (isPullRequest && pullRequestAction in ["opened", "reopened", "synchronize"])
then:
taskId: {$if: 'tasks_for != "action"', then: '${ownTaskId}'}
taskGroupId:
$if: 'tasks_for == "action"'
then:
'${action.taskGroupId}'
else:
'${ownTaskId}' # same as taskId; this is how automation identifies a decision task
schedulerId: '${trustDomain}-level-${level}'
created: {$fromNow: ''}
deadline: {$fromNow: '1 day'}
expires: {$fromNow: '1 year 1 second'} # 1 second so artifacts expire first
metadata:
$merge:
- owner: "${ownerEmail}"
source: "${repoUrl}/raw/${head_sha}/.taskcluster.yml"
- $switch:
'tasks_for == "github-push" || isPullRequest':
name: "Decision Task"
description: 'The task that creates all of the other tasks in the task graph'
'tasks_for == "action"':
name: "Action: ${action.title}"
description: |
${action.description}

Action triggered by clientID `${clientId}`
$default:
name: "Decision Task for cron job ${cron.job_name}"
description: 'Created by a [cron task](https://firefox-ci-tc.services.mozilla.com/tasks/${cron.task_id})'

provisionerId: "${trustDomain}-${level}"
workerType: "decision"

tags:
$switch:
'tasks_for == "github-push" || isPullRequest':
createdForUser: "${ownerEmail}"
kind: decision-task
'tasks_for == "action"':
createdForUser: '${ownerEmail}'
kind: 'action-callback'
'tasks_for == "cron"':
kind: cron-task

routes:
$flatten:
- checks
- $switch:
'tasks_for == "github-push"':
- "index.${trustDomain}.v2.${project}.latest.taskgraph.decision"
- "index.${trustDomain}.v2.${project}.revision.${head_sha}.taskgraph.decision"
'tasks_for == "action"':
- "index.${trustDomain}.v2.${project}.revision.${head_sha}.taskgraph.actions.${ownTaskId}"
'tasks_for == "cron"':
- "index.${trustDomain}.v2.${project}.latest.taskgraph.decision-${cron.job_name}"
- "index.${trustDomain}.v2.${project}.revision.${head_sha}.taskgraph.decision-${cron.job_name}"
# list each cron task on this revision, so actions can find them
- 'index.${trustDomain}.v2.${project}.revision.${head_sha}.cron.${ownTaskId}'
$default: []

scopes:
$switch:
'tasks_for in ["github-push"]':
$let:
short_head_ref:
$if: 'head_ref[:10] == "refs/tags/"'
then: {$eval: 'head_ref[10:]'}
else:
$if: 'head_ref[:11] == "refs/heads/"'
then: {$eval: 'head_ref[11:]'}
else: ${head_ref}
in:
- 'assume:repo:${repoUrl[8:]}:branch:${short_head_ref}'
'isPullRequest':
- 'assume:repo:github.com/${event.pull_request.base.repo.full_name}:${tasks_for[7:]}'
'tasks_for == "action"':
- 'assume:repo:${repoUrl[8:]}:action:${action.action_perm}'
$default:
- 'assume:repo:${repoUrl[8:]}:cron:${cron.job_name}'

dependencies: []
requires: all-completed

priority:
$switch:
'tasks_for == "cron"': low
'tasks_for == "github-push"|| isPullRequest': very-low
$default: lowest # tasks_for == 'action'
retries: 5

payload:
$let:
normProject:
$eval: 'join(split(project, "-"), "_")'
normProjectUpper:
$eval: 'uppercase(join(split(project, "-"), "_"))'
in:
env:
# run-task uses these to check out the source; the inputs to
# `taskgraph decision` are all on the command line.
$merge:
- ${normProjectUpper}_BASE_REPOSITORY: '${baseRepoUrl}'
${normProjectUpper}_BASE_REF: '${short_base_ref}'
${normProjectUpper}_BASE_REV: '${base_sha}'
${normProjectUpper}_HEAD_REPOSITORY: '${repoUrl}'
${normProjectUpper}_HEAD_REF: '${short_head_ref}'
${normProjectUpper}_HEAD_REV: '${head_sha}'
${normProjectUpper}_REPOSITORY_TYPE: git
REPOSITORIES:
$json:
${normProject}: ${normProject}
- $if: 'isPullRequest'
then:
${normProjectUpper}_PULL_REQUEST_NUMBER: '${event.pull_request.number}'
- $if: 'tasks_for == "action"'
then:
ACTION_TASK_GROUP_ID: '${action.taskGroupId}' # taskGroupId of the target task
ACTION_TASK_ID: {$json: {$eval: 'taskId'}} # taskId of the target task (JSON-encoded)
ACTION_INPUT: {$json: {$eval: 'input'}}
ACTION_CALLBACK: '${action.cb_name}'

cache:
"${trustDomain}-project-${project}-level-${level}-checkouts-sparse-v3": /builds/worker/checkouts

features:
taskclusterProxy: true

image: mozillareleases/taskgraph:decision-v24.1.1@sha256:c2cf963f7621b0f64dc142a04ddcc179d36afdd05c6dc1c2d198d97b55ecb394
maxRunTime: 1800

command:
- run-task
- '--${normProject}-checkout=/builds/worker/checkouts/src'
- '--'
- bash
- -cx
- $let:
extraArgs: {$if: 'tasks_for == "cron"', then: '${cron.quoted_args}', else: ''}
in:
$if: 'tasks_for == "action"'
then: >
cd /builds/worker/checkouts/src &&
ln -s /builds/worker/artifacts artifacts &&
taskgraph action-callback
else: >
cd /builds/worker/checkouts/src &&
ln -s /builds/worker/artifacts artifacts &&
taskgraph decision
--pushlog-id='0'
--pushdate='0'
--project='${project}'
--owner='${ownerEmail}'
--level='${level}'
--repository-type=git
--tasks-for='${tasks_for}'
--base-repository='${baseRepoUrl}'
--base-ref='${short_base_ref}'
--base-rev='${base_sha}'
--head-repository='${repoUrl}'
--head-ref='${short_head_ref}'
--head-rev='${head_sha}'
${extraArgs}

artifacts:
'public':
type: 'directory'
path: '/builds/worker/artifacts'
expires: {$fromNow: '1 year'}
'public/docker-contexts':
type: 'directory'
path: '/builds/worker/checkouts/src/docker-contexts'
# This needs to be at least the deadline of the
# decision task + the docker-image task deadlines.
# It is set to a week to allow for some time for
# debugging, but they are not useful long-term.
expires: {$fromNow: '7 day'}

extra:
$merge:
- $if: 'tasks_for == "action"'
then:
parent: '${action.taskGroupId}'
action:
name: '${action.name}'
context:
taskGroupId: '${action.taskGroupId}'
taskId: {$eval: 'taskId'}
input: {$eval: 'input'}
clientId: {$eval: 'clientId'}
- $if: 'tasks_for == "cron"'
then:
cron: {$json: {$eval: 'cron'}}
- tasks_for: '${tasks_for}'
pullRequests: public_restricted
tasks: []