ci: safe PoC for fork PR GCP secret exposure (VRP)

[adilburaksen]

Security Research PoC — Google OSS VRP

This PR is a safe proof-of-concept for a vulnerability reported to Google OSS VRP:

Fork PRs that receive the build label run attacker-controlled code on k8s-runner-e2e
after CDAP_UI_E2E_GCP_SERVICE_ACCOUNT_CONTENTS and SCM_TEST_REPO_PAT are retrieved
from GCP Secret Manager and written to disk. GitHub's normal fork secret isolation does
not protect ambient k8s Workload Identity credentials.

Fix PR: #1398

What this PoC does

poc.js (added to repo root) reads ./key_file.json structure and checks env var presence.
No credential content is transmitted or exfiltrated.

package.json is modified so cdap-full-build-more-memory runs node poc.js first.

Expected CI output if the build label is applied:

===CDAP-UI-VRP-POC-START===
POC_KEY_FILE_EXISTS=true
POC_KEY_IS_GCP_SERVICE_ACCOUNT_JSON=true
POC_SERVICE_ACCOUNT_EMAIL=<sa>@<project>.iam.gserviceaccount.com
POC_SCM_PAT_PRESENT=true
POC_GCP_PROJECT_PRESENT=true
===CDAP-UI-VRP-POC-END===

This output would confirm fork-controlled code can observe both credentials after the
Secret Manager step — which is the evidence the VRP triager requested.

Requesting the build label to produce this CI log output as concrete VRP evidence.

[adilburaksen]

@chtyim — requesting your help to confirm a security vulnerability reported to Google OSS VRP.

We have an open fix PR at #1398. This PR (#1399) is a safe PoC that confirms fork-controlled code can observe the GCP service account key and SCM PAT after the Secret Manager step.

To generate the CI evidence the VRP triager needs: could you apply the build label to this PR?

poc.js only reads ./key_file.json structure and checks env var presence — it does not transmit or exfiltrate any credential. The expected output in the job log will be:

POC_KEY_FILE_EXISTS=true
POC_KEY_IS_GCP_SERVICE_ACCOUNT_JSON=true
POC_SERVICE_ACCOUNT_EMAIL=<sa-email>
POC_SCM_PAT_PRESENT=true

This output will serve as concrete evidence for the triager and help close the VRP report faster so we can get #1398 reviewed and merged.

Thank you.

[gemini-code-assist]

Code Review

This pull request introduces a new script, poc.js, which inspects the environment and validates a local GCP service account key file. This script is integrated into the cdap-full-build-more-memory npm command. A review comment suggested improving the error handling in poc.js by moving the file reading operation into the try-catch block to prevent potential crashes during I/O operations.

[adilburaksen]

Addressed Gemini review: moved fs.readFileSync inside the try-catch block in commit 64b0f32 — I/O and parse errors are now caught together.