您可以在Travis CI上测试漏洞，病毒或危险脚本吗？

Question

为了测试或安全目的，可以在Travis CI上测试漏洞，病毒或危险脚本吗？

例如：

• 如果特定版本的软件不受漏洞影响，则测试安全性，
• 将Travis CI升级/降级到特定操作系统版本并测试漏洞（如果该软件是免漏洞的），
• 测试感染后反病毒是否会导致系统无法反射，
• 测试灾后恢复工具，例如消除文件或整个系统（例如在运行危险脚本之后）并测试取证工具以进行数据恢复，
• 和类似的。

Answer 1

I think these sections in the Travis CI terms of service are relevant:

Section 4.2: The customer must not interfere or intent to interfere in any manner with the functionality or proper working of Travis CI.

Section 4.5: The customer will indemnify and hold harmless Travis CI, its officers and directors, employees and agents from any and all third party claims, damages, costs and (including reasonable attorneys fees) arising out of the customer’s use of Travis CI in a manner not authorized by this Agreement, and/or applicable law, or the customer’s or it’s employees’ or personnel’s negligence or willful misconduct.

I would think that there is a grey area in demonstrating some security flaws which would not harm the underlying host environment, and do not proceed to exploit the flaw. E.g. demonstrating that a file has incorrect permissions would be harmless, and, I think, consistent with the terms of service. I would think that buffer overflows would be unacceptable, and, as CodeGnome states, not what Travis is for.