pvharmo2/gha-lab-d9fd584b12Authorized security-research lab reproducing CVE-2024-47179 (GHSL-2024-178): artifact-poisoning pwn-request chain in RSSHub docker-test workflows (snapshot at 574d053)
Automated research artifact — not the upstream project.
This repository is a disposable lab built by an automated harness for a master's thesis at Université Laval on reproducing published GitHub Actions workflow vulnerabilities. It is a verbatim snapshot of
DIYgod/RSSHubat commit574d053ad3f393ba67d635875b70fa4abde2995b(2024-09-09), redistributed under that project's own licence, whose file is included unchanged in this snapshot.The upstream project is not involved, is never targeted, and the vulnerability studied here is already public. Every secret and variable in this repository is a randomly generated dummy value — no real credential is present. Action references and runner images are pinned to what they resolved to on 2024-09-09; see
pinning.mdin the harness output for every change made to the snapshot.Questions or objections: [email protected]
🧡 Everything is RSSible
RSSHub is an open source, easy to use, and extensible RSS feed generator. It's capable of generating RSS feeds from pretty much everything.
RSSHub delivers millions of contents aggregated from all kinds of sources, our vibrant open source community is ensuring the deliver of RSSHub's new routes, new features and bug fixes.
RSSHub can be used with browser extension RSSHub Radar and mobile auxiliary app RSSBud (iOS) and RSSAid (Android)
Logo designer sheldonrrr
We welcome all pull requests. Suggestions and feedback are also welcomed here.
Refer to Join Us
Refer to Deployment
Refer to Support RSSHub
RSSHub is open source and completely free under the MIT license. However, just like any other open source project, as the project grows, the hosting, development and maintenance requires funding support.
You can support RSSHub via donations.
Recurring donors will be rewarded via express issue response, or even have your name displayed on our GitHub page and website.
We accept donations via the following ways:
Open source is a very expensive thing. RSSHub would not be possible without the help of these individuals and organizations.
RSSHub © DIYgod, Released under the MIT License.
Authored and maintained by DIYgod with help from contributors (list).
Blog @DIYgod · GitHub @DIYgod · Twitter @DIYgod · Telegram Channel @awesomeDIYgod
