r/programming • u/senatorium • Apr 15 '21

Codecov's Bash Uploader for Coverage Reports Compromised

https://about.codecov.io/security-update/
66 Upvotes

93% Upvoted

22 comments sorted by

View all comments

6

u/somethingLethal Apr 16 '21

Thought I would share this, as it should help validate the integrity of their shell script, before running it.

If your CI script is doing this:

bash <(curl -s https://codecov.io/bash)

Replace it with something like the following:

#/bin/bash
FILENAME=codecov
curl -s https://codecov.io/bash > $FILENAME
CODECOV_VERSION=$(grep 'VERSION=\".*\"' codecov | cut -d'"' -f2);
VALIDATION_FAILURE=0
for i in 1 256 512
do
  IS_DIFF=$(diff <(shasum -a $i $FILENAME) <(curl -s https://raw.githubusercontent.com/codecov/codecov-bash/$CODECOV_VERSION/SHA${i}SUM))
  if [ -z "${IS_DIFF}" ]; then
    echo "Sha:" $i "passes validation."
  else
    VALIDATION_FAILURE=1
  fi
done
if [ "${VALIDATION_FAILURE}" == 1 ]; then
  echo "Invalid Checksum Detected From Codecov. Quitting."
  exit 1
else
  echo "Starting Codecov."
  chmod +x codecov
  ./codecov
fi
rm -rf $FILENAME

10

u/[deleted] Apr 16 '21

This is why I always thought piping crap from the web straight into bash felt insane. Turns out the hackers thought it was insane too, and used it to devastating effect.

How about, you know, just downloading the script and putting it in your own damn repo?

1

u/anakin0491 Apr 16 '21

This was useful, thank you!