Unable to deploy PRs

[praveen-livspace]

Component

server, web-ui

Describe the bug

I noticed that PRs can no longer be deployed using the web UI due to this change #3522
However this has broken our UX where our team deploys the PRs in dev/alpha environments to carry out testing before the PR is merged. Please suggest.

System Info

{"source":"https://github.com/woodpecker-ci/woodpecker","version":"next-326069c983"}

Additional context

No response

Validations

• Read the docs.
• Check that there isn't already an issue that reports the same bug to avoid creating a duplicate.
• Checked that the bug isn't fixed in the next version already [https://woodpecker-ci.org/faq#which-version-of-woodpecker-should-i-use]

[qwerty287]

We disabled PR deployments due to security concerns, because it would allow you to access deploy secrets even if you're not a repo admin.
To be honestly, I don't see a good way to prevent this except a new repo config with a warning that this can leak your secrets.
Do you have any idea?

[anbraten]

Deploy uses secrets enabled for the deploy event. Clicking the deloy button can be done by every repo member (not by externals), right?

[qwerty287]

Clicking the deloy button can be done by every repo member (not by externals), right?

Yes. So you can access any secret if you have push perms but they should only be available with admin perms.

[anbraten]

So you can access any secret if you have push perms

I might be wrong, but aren't just secrets with the deploy filter exposed to the compiler?

[qwerty287]

I might be wrong, but aren't just secrets with the deploy filter exposed to the compiler?

I'm not sure about this, but how is this important?

The workflow to get a secret that's only intended for deployments would be:

1. Open a PR with a malicious woodpecker config (e.g. sending secret value to a remote server)
2. Wait until the pipeline finished
3. Click the "deploy" button
4. The same pipeline will be executed with the deploy event and thus has access to all deploy secrets

[anbraten]

Click the "deploy" button

As clicking the deploy button can only be done by a repo member.

Isn't it the same risk as this:

• A member pushes to a branch
• Wait until the pipeline finished
• Click the "deploy" button
• ...

[qwerty287]

Isn't it the same risk as this:

In general, yes, however, you can easily block that using branch protections. Blocking PRs is much harder and probably nobody will do it as it drastically reduces usability.

Maybe it's the best idea to be able to disable the deploy button completely, but if it's enabled allow all events? And add a warning similar to PR secrets?

[praveen-livspace]

IMO, we should have a config to enable or disable deployment on PRs. We can keep it disabled by default. However, for private environments the risk is minimal.