Skip to content

[FSSDK-12314] Remove SourceClear scan workflow due to security vulnerability#1139

Merged
Tamara-Barum merged 1 commit intomasterfrom
remove-sourceclear-vulnerability
Mar 11, 2026
Merged

[FSSDK-12314] Remove SourceClear scan workflow due to security vulnerability#1139
Tamara-Barum merged 1 commit intomasterfrom
remove-sourceclear-vulnerability

Conversation

@Tamara-Barum
Copy link
Contributor

Removes the SourceClear workflow that contains a dangerous curl|bash pattern, which presents risks of script injection and untrusted remote code execution in the CI/CD pipeline. This follows the same remediation approach used in the PHP SDK (optimizely/php-sdk#294).

Summary

Security Risk

The removed workflow executed:

curl -sSL https://download.sourceclear.com/ci.sh | bash -s - scan
This pattern is vulnerable because it:

Downloads and executes untrusted code without verification
Has no integrity checks
Is susceptible to DNS/MITM attacks
Test Plan
 Verify the workflow file is removed from .github/workflows/
 Confirm no other workflows depend on the source_clear job
 Check that CI/CD pipeline runs successfully without this workflow


## Issues
(https://optimizely-ext.atlassian.net/browse/FSSDK-12314)

Removes the SourceClear workflow that contains a dangerous curl|bash pattern,
which presents risks of script injection and untrusted remote code execution
in the CI/CD pipeline. This follows the same remediation approach used in the
PHP SDK (optimizely/php-sdk#294).

Co-Authored-By: Claude Sonnet 4.5 <noreply@anthropic.com>
@coveralls
Copy link

Coverage Status

coverage: 77.733%. remained the same
when pulling c706c1e on remove-sourceclear-vulnerability
into 5af7f3b on master.

Copy link
Contributor

@esrakartalOpt esrakartalOpt left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM 👍

@Tamara-Barum Tamara-Barum merged commit cde46e9 into master Mar 11, 2026
36 of 37 checks passed
@Tamara-Barum Tamara-Barum deleted the remove-sourceclear-vulnerability branch March 11, 2026 21:13
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

3 participants