Prevent code execution

[Coda1304]

How are you running Renovate?

Self-hosted Renovate

If you're self-hosting Renovate, tell us which platform (GitHub, GitLab, etc) and which version of Renovate.

Gitlab - Renovate 39.62.3

Please tell us more about your question or problem

Hello,
we are setting up a central Renovate instance in our company. Users should have the option to invite themselves self-service.
In the documentation it is mentioned that there is an inherent risk of insider attacks as Renovate executes code from the repository. Link to there relevant part of the documentation. Due to the size of our company we can't check each repository manually as it is stated there.
In order to minimize this risk we are now disabling postUpgradeTasks and all wrapper that we find which execute arbitrary code from the repository. In the documentation only gradlew is mentioned, but we aren't sure if gradlew is the only one.

Why are we trying to do this?
Someone inside the company was already showing in a POC that they could extract the used Renovate Token to interact with our Gitlab instance. With this token they have the option to impersonate our used Service Account and push any code changes with Developer/Maintainer permissions to all repositories. This obviously is a huge risk.

Therefore I have the following questions:

1. Is there a complete list of all managers which execute arbitrary code from the repository?
2. Is there maybe a central configuration option inside the Self-Hosted Configuration to disable this behaviour in a central place?
3. Are there any other mitigation strategies which could be used?
4. We also checked out binarySource=docker, but as we are running Renovate inside a Kubernetes cluster and the docker socket isn't available, this doesn't seem to be an option. In some Github issues this was mentioned to work, but unfortunately without any explanation or link to further documentation. See: Issue-19961

Thank you very much for your support.

Logs (if relevant)

No response

[rarkins]

1. No
2. No, but allowScripts is related
3. Run inside microVMs or similar instead of containers
4. This is not planned, unless a Mend.io customer was willing to sponsor it

[Coda1304]

Thank you for the fast answer.
To the first question. Are there any other known which execute code from the repository? This would already help us reduce the attack surface.

[rarkins]

I don't recall any other obvious ones, but you need to assume - just like with CI - that your internal developers can execute anything.