From 06e2cdbf5cf3559b5d3a8d9ce976e4a8beaa0ce4 Mon Sep 17 00:00:00 2001
From: Kevin Zhao <kevin8093@126.com>
Date: Fri, 6 Mar 2026 06:27:33 +0800
Subject: [PATCH] [github-actions] fix pwn-request vulnerability in size.yml
 workflow (#12625)

The size.yml workflow used pull_request_target with git checkout
FETCH_HEAD, which replaced the entire working directory (including
scripts) with untrusted fork code. Since pull_request_target grants
a read/write GITHUB_TOKEN even from public forks, and the workflow
had no top-level permissions restriction, this allowed arbitrary
code execution with write access to the repository.

Fix by:
1. Adding top-level permissions: contents: read (consistent with
   all other workflows in this repository).
2. Replacing `git checkout FETCH_HEAD` with a fetch-only approach
   that passes the PR merge commit SHA via the OT_SHA_NEW environment
   variable. The check-size script uses git-archive to extract code
   by SHA, so it does not need the working directory to be switched.
   This ensures ./script/check-size always runs from the base branch.
3. Updating check-size to accept OT_SHA_NEW from the environment,
   falling back to git rev-parse HEAD when not set (preserving
   existing behavior for push-triggered and local runs).
---
 .github/workflows/size.yml | 9 ++++++---
 script/check-size          | 2 +-
 2 files changed, 7 insertions(+), 4 deletions(-)

diff --git a/.github/workflows/size.yml b/.github/workflows/size.yml
index 573dc5bf7..0fdfb3ff8 100644
--- a/.github/workflows/size.yml
+++ b/.github/workflows/size.yml
@@ -36,6 +36,9 @@ on:
     branches:
       - 'main'
 
+permissions:
+  contents: read
+
 concurrency:
   group: ${{ github.workflow }}-${{ github.event.pull_request.number || (github.repository == 'openthread/openthread' && github.run_id) || github.ref }}
   cancel-in-progress: true
@@ -51,11 +54,11 @@ jobs:
         egress-policy: audit # TODO: change to 'egress-policy: block' after couple of runs
 
     - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
-    - name: Checkout Pull Request
+    - name: Fetch Pull Request ref
       if: ${{ github.event_name == 'pull_request_target' }}
       run: |
-        git fetch origin pull/${{ github.event.pull_request.number }}/merge
-        git checkout FETCH_HEAD
+        git fetch --depth 2 origin pull/${{ github.event.pull_request.number }}/merge
+        echo "OT_SHA_NEW=$(git rev-parse FETCH_HEAD)" >> $GITHUB_ENV
     - name: Run
       env:
         PR_BODY: "${{ github.event.pull_request.body }}"
diff --git a/script/check-size b/script/check-size
index 95c1955c5..fde770b01 100755
--- a/script/check-size
+++ b/script/check-size
@@ -32,7 +32,7 @@ set -euo pipefail
 OT_TMP_DIR=/tmp/ot-size-report
 readonly OT_TMP_DIR
 
-OT_SHA_NEW="$(git rev-parse HEAD)"
+OT_SHA_NEW="${OT_SHA_NEW:-$(git rev-parse HEAD)}"
 readonly OT_SHA_NEW
 
 OT_SHA_OLD="${OT_SHA_OLD:-$(git cat-file -p "${OT_SHA_NEW}" | grep 'parent ' | head -n1 | cut -d' ' -f2)}"