irsl

jobs:
  trusted_preparation_step:
    permissions: {}
	steps:
	  - name: produce_executable
	    run: |
		  # produce trusted_executable
      - uses: actions/upload-artifact@v4
		with:
	      name: trusted_executable

irsl

#!/usr/bin/env python3

import json
import re
import requests
import sys

def slurp(p):
    with open(p, "r") as f:
        return f.read()

irsl

    def self.invoice_for_number(zuora_invoice_number)
      response = GitHub.zuorest_client.query_action queryString: "select Id from Invoice where InvoiceNumber = '#{zuora_invoice_number}'"

      response["records"].map { |record| new(record["Id"]) }.first
    end

irsl

 sig { params(incl_filters: T::Array[String], excl_filters: T::Array[String], table: T.nilable(String)).void }
...

          sig { override.returns(T.nilable(String)) }
          memoize def query_clause
            incl_slugs, excl_slugs = resolve_filters
            return "1=0" if !incl_slugs.nil? && incl_slugs.empty?

            predicates = []
            predicates << "#{@col} IN (#{incl_slugs.map { |f| "'#{f}'" }.join(', ')})" unless incl_slugs.nil?

irsl

admin@ggithub-duckdns-org:~$ github-env
git@ggithub-duckdns-org:/github$ toggle-feature-flag enable ospo_insights_enabled irsleorg
...
=> ospo_insights_enabled enabled for irsleorg

git@ggithub-duckdns-org:/github$ toggle-feature-flag enable insights_legacyplan_enabled irsleorg
...
=> insights_legacyplan_enabled enabled for irsleorg

irsl

  fetch('/orgs/irsleorg/insights/org_issue_trend_data', {
   method: 'POST',
   headers: {
	 'GitHub-Verified-Fetch': 'true', 'Content-type': 'application/json'
   },
   body: JSON.stringify({repos: "arbitrary-string-here"}), // SQLi here!
 })
  .then(response => {
    console.log("response", response)
	return response.text();

irsl

  def issue_where_clause
    repo_ids = params[:repos].present? ? params[:repos].split(",") : []

    if !repo_ids.empty?
      "I.RepositoryId IN (#{repo_ids.join(', ')}) "
    end
  end

  def ospo_issue_trend_data # rubocop:todo GitHub/UseRestfulActions
    return render_404 unless this_organization.ospo_insights_enabled?

irsl

admin@ggithub-duckdns-org:~$ sudo chroot --userspec nobody:nogroup / /bin/bash
bash: /root/.bashrc: Permission denied

nobody@ggithub-duckdns-org:/$ cat /proc/self/status
Name:   cat
Umask:  0022
State:  R (running)
Tgid:   5104
Ngid:   0
Pid:    5104

irsl

# ./opensnoop language-stats.cache
COMM             PID      FD FILE
...
<...>            14798   0xa /data/repositories/a/nw/a5/77/1b/38/38.git/language-stats.cache
<...>            14799   0xa /data/repositories/a/nw/a5/77/1b/38/38.git/language-stats.cache
...

# forkstat
...
17:49:57 fork  14798 child           aqueduct-0.3.6 [522ffd7]: Processing job 95861f61-5359-4a36-9be8-6b271e8ef38c from tech_project_stack since 1692467397: RepositoryUpdateTechProjectAndStackJob

irsl

    def load(cache_file)
      marshal = File.open(cache_file, "rb") { |f| Zlib::Inflate.inflate(f.read) }
      Marshal.load(marshal)
    rescue SystemCallError, ::Zlib::DataError, ::Zlib::BufError, TypeError
      nil
    end