{"id":118226,"date":"2024-07-25T15:43:00","date_gmt":"2024-07-25T13:43:02","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/dostup-k-dannym-iz-udalyonnyh-i-privatnyh-repozitoriev-na-github-imeyushhih-forki"},"modified":"2024-07-25T15:43:00","modified_gmt":"2024-07-25T13:43:02","slug":"dostup-k-dannym-iz-udalyonnyh-i-privatnyh-repozitoriev-na-github-imeyushhih-forki","status":"publish","type":"post","link":"https:\/\/prohoster.info\/sq\/blog\/novosti-interneta\/dostup-k-dannym-iz-udalyonnyh-i-privatnyh-repozitoriev-na-github-imeyushhih-forki","title":{"rendered":"Akses n\u00eb t\u00eb dh\u00ebnat nga repo t\u00eb larg\u00ebta dhe private n\u00eb GitHub, q\u00eb kan\u00eb forke","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"
Kompania Truffle Security publikoi skenar\u00eb sulmesh ndaj disa teknikave tipike t\u00eb pun\u00ebs me depozit\u00eb n\u00eb GitHub, t\u00eb cilat lejojn\u00eb nxjerrjen e t\u00eb dh\u00ebnave nga depozita t\u00eb larg\u00ebta q\u00eb kan\u00eb forka publike ose q\u00eb jan\u00eb krijuar si forka. <\/p>\n
Mund\u00ebsia e aksesit n\u00eb komit\u00ebt p\u00ebrmes hash-it n\u00eb t\u00eb gjitha forkat e lidhura me depozit\u00ebn \u00ebsht\u00eb shkaktuar nga fakti q\u00eb GitHub, p\u00ebr q\u00ebllime optimizimi dhe p\u00ebr t\u00eb eliminuar kopjet, ruan s\u00eb bashku t\u00eb gjith\u00eb objektet nga depozita kryesore dhe forkat, duke ndar\u00eb logjikisht p\u00ebrkat\u00ebsin\u00eb e komit\u00ebve. Kjo ruajtje lejon q\u00eb t\u00eb shikohet n\u00eb depozit\u00ebn kryesore \u00e7do komit nga \u00e7do fork, duke e sh\u00ebnuar qart\u00eb hash-in e tij n\u00eb URL. P\u00ebr shembull, nj\u00eb p\u00ebrdorues mund t\u00eb krijoj\u00eb nj\u00eb fork t\u00eb depozit\u00ebs '\/torvalds\/linux' dhe t\u00eb shtoj\u00eb n\u00eb t\u00eb \u00e7do kod, pas s\u00eb cil\u00ebs ky kod do t\u00eb jet\u00eb i aksesuesh\u00ebm p\u00ebrmes nj\u00eb lidhjeje t\u00eb drejtp\u00ebrdrejt\u00eb hash n\u00eb depozit\u00ebn '\/torvalds\/linux'. N\u00eb rastin e fshirjes s\u00eb depozit\u00ebs, n\u00ebse ekziston t\u00eb pakt\u00ebn nj\u00eb fork publik, t\u00eb dh\u00ebnat nga depozita e larg\u00ebt mbeten t\u00eb aksesueshme p\u00ebrmes hash-it t\u00eb komitit. <\/p>\n
Propozohet tri skenar\u00eb q\u00eb paraqesin k\u00ebrc\u00ebnim p\u00ebr sigurin\u00eb: <\/p>\n
\n
Skema e par\u00eb trajton situatat kur zhvilluesit krijojn\u00eb forka t\u00eb repo publik, shtojn\u00eb ndryshime n\u00eb to, eksperimentojn\u00eb dhe m\u00eb pas i fshijn\u00eb. P\u00ebrve\u00e7 rrjedhjes s\u00eb kodit q\u00eb nuk \u00ebsht\u00eb menduar p\u00ebr publikim, rreziku paraqet situata kur gjat\u00eb eksperimenteve n\u00eb kodin e skedar\u00ebve me shembuj shtohen \u00e7el\u00ebsa t\u00eb pun\u00ebs p\u00ebr akses n\u00eb API. N\u00eb k\u00ebt\u00eb rast, nj\u00eb sulmues mund t\u00eb fitoj\u00eb qasje n\u00eb ndryshimin sipas hash-it t\u00eb komitit, q\u00eb adresohet pas fshirjes s\u00eb forkut p\u00ebrmes repo kryesor. P\u00ebr shembull, n\u00ebp\u00ebrmjet metod\u00ebs s\u00eb propozuar, hulumtuesit arrit\u00ebn t\u00eb identifikojn\u00eb 30 \u00e7el\u00ebsa t\u00eb pun\u00ebs p\u00ebr akses n\u00eb API duke studiuar tre repo t\u00eb lidhura me m\u00ebsimin e makinerive me nj\u00eb num\u00ebr t\u00eb madh forkesh.\n
Skenari i dyt\u00eb ka t\u00eb b\u00ebj\u00eb me mund\u00ebsin\u00eb e marrjes s\u00eb qasjes n\u00eb t\u00eb dh\u00ebna pas fshirjes s\u00eb depozit\u00ebs p\u00ebrkat\u00ebse, n\u00ebse p\u00ebr k\u00ebt\u00eb depozit\u00eb jan\u00eb krijuar forka. Si nj\u00eb shembull jepet rasti kur n\u00eb nj\u00eb depozite publike t\u00eb nj\u00eb kompanie u publikuan aksidentalisht \u00e7el\u00ebsat e mbyllur t\u00eb nj\u00eb prej punonj\u00ebsve, duke lejuar qasje t\u00eb plot\u00eb n\u00eb t\u00eb gjitha depozit\u00eb e k\u00ebsaj kompanie n\u00eb GitHub. Kompania e fshiu depozit\u00ebn p\u00ebrmes s\u00eb cil\u00ebs ndodhi rrjedhja, por \u00e7el\u00ebsat ende mbet\u00ebn t\u00eb disponuesh\u00ebm p\u00ebr t'u t\u00ebrhequr p\u00ebrmes thirrjeve me hash-in e komit n\u00eb depozit\u00eb me forkat.
<\/center>\n
Skenari i tret\u00eb lidhet me modelin e zhvillimit t\u00eb projekteve, t\u00eb cilat zhvillojn\u00eb nj\u00eb version bazik t\u00eb hapur n\u00eb nj\u00eb depo publike dhe nj\u00eb version t\u00eb zgjeruar pronar n\u00eb nj\u00eb depo private. N\u00ebse nj\u00eb kompani fillimisht zhvilloi projektin n\u00eb nj\u00eb depo private dhe m\u00eb pas, pas hapjes s\u00eb kodit t\u00eb projektit, e kaloi at\u00eb n\u00eb kategorin\u00eb e projekteve publike, por vazhdoi zhvillimin e nj\u00eb versioni t\u00eb mbyllur t\u00eb brendsh\u00ebm ose t\u00eb zgjeruar n\u00eb nj\u00eb fork privat, at\u00ebher\u00eb ekziston mund\u00ebsia e qasjes n\u00eb ndryshimet e nd\u00ebrlidhura me fork-un privat p\u00ebrmes hash-eve t\u00eb komiteteve p\u00ebrmes depozites publike. N\u00eb k\u00ebt\u00eb rast, qasja \u00ebsht\u00eb e mundur vet\u00ebm p\u00ebr ndryshimet, q\u00eb jan\u00eb shtuar n\u00eb fork-un privat p\u00ebrpara se depoja kryesore t\u00eb kalonte n\u00eb kategorin\u00eb e projekteve publike (depozitat e depozitimeve private dhe publike jan\u00eb t\u00eb ndara, por, kur dy depozita ishin private, komitetet ruheshin s\u00eb bashku, prandaj mbet\u00ebn n\u00eb depo pas kalimit t\u00eb saj n\u00eb kategorin\u00eb e projekteve publike).
<\/center> <\/ul>\n
Nj\u00eb truk q\u00eb lejon qasje n\u00eb komitetet n\u00eb fork-et e nj\u00eb depoje p\u00ebrmes lidhjes me depozit\u00ebn kryesore \u00ebsht\u00eb njohur p\u00ebr shum\u00eb vite dhe p\u00ebrdoret her\u00eb pas here p\u00ebr shaka t\u00eb ndryshme dhe p\u00ebr t\u00eb mashtruar zhvilluesit (p.sh., shakat\u00eb ndonj\u00ebher\u00eb krijojn\u00eb nj\u00eb dukje t\u00eb z\u00ebvend\u00ebsimit t\u00eb backdoor-ve n\u00eb depozit\u00ebn me thelb Linux n\u00eb GitHub). Si nj\u00eb mas\u00eb p\u00ebr t\u00eb parandaluar k\u00ebto shaka, GitHub ka shtuar nj\u00eb paralajm\u00ebrim q\u00eb komiteti i k\u00ebrkuar nuk i p\u00ebrket deg\u00ebve n\u00eb depozit\u00ebn aktuale dhe mund t\u00eb p\u00ebrkas\u00eb nj\u00eb fork. Megjithat\u00eb, vet\u00eb mund\u00ebsia p\u00ebr t\u00eb aksesuar komitetet p\u00ebrmes hash-it n\u00eb \u00e7do fork t\u00eb lidhur me depozit\u00ebn \u00ebsht\u00eb par\u00eb si e pad\u00ebmshme, pasi k\u00ebrkohet njohja e hash-it t\u00eb komitetit p\u00ebr t\u00eb aksesuar t\u00eb dh\u00ebnat n\u00eb fork-et e larg\u00ebta dhe private. <\/p>\n
Gjetja e nj\u00eb hesh komiteti t\u00eb krijuar mbi baz\u00ebn e algoritmit SHA-1 dhe duke p\u00ebrfshir\u00eb 32 karaktere, nuk \u00ebsht\u00eb e mundur, por dol\u00ebm n\u00eb p\u00ebrfundimin se kjo nuk \u00ebsht\u00eb e nevojshme. GitHub mb\u00ebshtet nj\u00eb form\u00eb t\u00eb shkurtuar t\u00eb adresimit t\u00eb komiteteve, duke lejuar adresimin e ndryshimeve p\u00ebrmes disa karaktereve t\u00eb para t\u00eb heshit, p\u00ebr sa koh\u00eb q\u00eb nuk ka mbivendosje me komitete t\u00eb tjera. Numri minimal i karaktereve p\u00ebr adresimin e shkurtuar t\u00eb heshit \u00ebsht\u00eb 4, q\u00eb korrespondon me gjith\u00eb 65 mij\u00eb kombinime (16^4). Megjithat\u00eb, ndoshta nuk \u00ebsht\u00eb e nevojshme t\u00eb b\u00ebhet k\u00ebrkimi, pasi API GitHub lejon lidhen proceset p\u00ebr kapjen e ngjarjeve, t\u00eb cilat p\u00ebrdoren nga projekte t\u00eb jashtme, duke mbajtur nj\u00eb arkiv me t\u00eb gjitha operacionet, n\u00eb t\u00eb cilin informacioni rreth heshave t\u00eb komiteteve mbetet edhe pas fshirjes s\u00eb repozitor\u00ebve. \n Burimi: opennet.ru<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"
![\"Akses](\"\/wp-content\/uploads\/2024\/07\/45381deb03eaa5be40baf8b4dbf7b481.png\")
<\/center>\n![\"Akses](\"\/wp-content\/uploads\/2024\/07\/23342cf907bd300699e913297d29b310.png\")
<\/center> <\/ul>\n