Skip to content

Commit c1ae6bf

Browse files
dageckodagecko
committed
fix: quote env var references in run blocks
Did some research into the CodeQL envvar-injection-critical guidance (https://codeql.github.com/codeql-query-help/actions/actions-envvar-injection-critical/) and wanted to add this additional change to prevent shell injection through attacker-controllable values like ref names and workflow inputs, and to prevent unexpected behavior from special characters in secret values. Before: echo ${REF_NAME} After: echo "${REF_NAME}"
1 parent 0c823af commit c1ae6bf

1 file changed

Lines changed: 15 additions & 15 deletions

File tree

‎.github/workflows/release.yml‎

Lines changed: 15 additions & 15 deletions
Original file line numberDiff line numberDiff line change
@@ -83,9 +83,9 @@ jobs:
8383
# the cargo make script has to be run separately because of file locking issues
8484
run: |
8585
flutter config --enable-windows-desktop
86-
dart ./scripts/flutter_release_build/build_flowy.dart exclude-directives . ${REF_NAME}
87-
cargo make --env APP_VERSION=${REF_NAME} --profile production-windows-x86 appflowy
88-
dart ./scripts/flutter_release_build/build_flowy.dart include-directives . ${REF_NAME}
86+
dart ./scripts/flutter_release_build/build_flowy.dart exclude-directives . "${REF_NAME}"
87+
cargo make --env APP_VERSION="${REF_NAME}" --profile production-windows-x86 appflowy
88+
dart ./scripts/flutter_release_build/build_flowy.dart include-directives . "${REF_NAME}"
8989
9090
env:
9191
REF_NAME: ${{ github.ref_name }}
@@ -103,7 +103,7 @@ jobs:
103103
- name: Build installer executable
104104
working-directory: ${{ env.WINDOWS_APP_RELEASE_PATH }}
105105
run: |
106-
iscc /F${{ env.WINDOWS_INSTALLER_NAME }} inno_setup_config.iss /DAppVersion=${REF_NAME}
106+
iscc /F${{ env.WINDOWS_INSTALLER_NAME }} inno_setup_config.iss /DAppVersion="${REF_NAME}"
107107
108108
env:
109109
REF_NAME: ${{ github.ref_name }}
@@ -171,17 +171,17 @@ jobs:
171171
working-directory: frontend
172172
run: |
173173
flutter config --enable-macos-desktop
174-
dart ./scripts/flutter_release_build/build_flowy.dart run . ${REF_NAME}
174+
dart ./scripts/flutter_release_build/build_flowy.dart run . "${REF_NAME}"
175175
176176
env:
177177
REF_NAME: ${{ github.ref_name }}
178178
- name: Codesign AppFlowy
179179
run: |
180-
echo ${MACOS_CERTIFICATE} | base64 --decode > certificate.p12
180+
echo "${MACOS_CERTIFICATE}" | base64 --decode > certificate.p12
181181
security create-keychain -p action build.keychain
182182
security default-keychain -s build.keychain
183183
security unlock-keychain -p action build.keychain
184-
security import certificate.p12 -k build.keychain -P ${MACOS_CERTIFICATE_PWD} -T /usr/bin/codesign
184+
security import certificate.p12 -k build.keychain -P "${MACOS_CERTIFICATE_PWD}" -T /usr/bin/codesign
185185
security set-key-partition-list -S apple-tool:,apple:,codesign: -s -k action build.keychain
186186
/usr/bin/codesign --force --options runtime --deep --sign "${MACOS_CODESIGN_ID}" "${{ env.MACOS_APP_RELEASE_PATH }}/AppFlowy.app" -v
187187
@@ -212,7 +212,7 @@ jobs:
212212
done
213213
- name: Notarize AppFlowy
214214
run: |
215-
xcrun notarytool submit ${{ env.MACOS_APP_RELEASE_PATH }}/${{ env.MACOS_DMG_NAME }}.dmg --apple-id ${MACOS_NOTARY_USER} --team-id ${MACOS_TEAM_ID} --password ${MACOS_NOTARY_PWD} -v -f "json" --wait
215+
xcrun notarytool submit ${{ env.MACOS_APP_RELEASE_PATH }}/${{ env.MACOS_DMG_NAME }}.dmg --apple-id "${MACOS_NOTARY_USER}" --team-id "${MACOS_TEAM_ID}" --password "${MACOS_NOTARY_PWD}" -v -f "json" --wait
216216
217217
env:
218218
MACOS_NOTARY_USER: ${{ secrets.MACOS_NOTARY_USER }}
@@ -286,17 +286,17 @@ jobs:
286286
working-directory: frontend
287287
run: |
288288
flutter config --enable-macos-desktop
289-
sh scripts/flutter_release_build/build_universal_package_for_macos.sh ${REF_NAME}
289+
sh scripts/flutter_release_build/build_universal_package_for_macos.sh "${REF_NAME}"
290290
291291
env:
292292
REF_NAME: ${{ github.ref_name }}
293293
- name: Codesign AppFlowy
294294
run: |
295-
echo ${MACOS_CERTIFICATE} | base64 --decode > certificate.p12
295+
echo "${MACOS_CERTIFICATE}" | base64 --decode > certificate.p12
296296
security create-keychain -p action build.keychain
297297
security default-keychain -s build.keychain
298298
security unlock-keychain -p action build.keychain
299-
security import certificate.p12 -k build.keychain -P ${MACOS_CERTIFICATE_PWD} -T /usr/bin/codesign
299+
security import certificate.p12 -k build.keychain -P "${MACOS_CERTIFICATE_PWD}" -T /usr/bin/codesign
300300
security set-key-partition-list -S apple-tool:,apple:,codesign: -s -k action build.keychain
301301
/usr/bin/codesign --force --options runtime --deep --sign "${MACOS_CODESIGN_ID}" "${{ env.MACOS_APP_RELEASE_PATH }}/AppFlowy.app" -v
302302
@@ -320,7 +320,7 @@ jobs:
320320
321321
- name: Notarize AppFlowy
322322
run: |
323-
xcrun notarytool submit ${{ env.MACOS_APP_RELEASE_PATH }}/${{ env.MACOS_DMG_NAME }}.dmg --apple-id ${MACOS_NOTARY_USER} --team-id ${MACOS_TEAM_ID} --password ${MACOS_NOTARY_PWD} -v -f "json" --wait
323+
xcrun notarytool submit ${{ env.MACOS_APP_RELEASE_PATH }}/${{ env.MACOS_DMG_NAME }}.dmg --apple-id "${MACOS_NOTARY_USER}" --team-id "${MACOS_TEAM_ID}" --password "${MACOS_NOTARY_PWD}" -v -f "json" --wait
324324
325325
env:
326326
MACOS_NOTARY_USER: ${{ secrets.MACOS_NOTARY_USER }}
@@ -418,7 +418,7 @@ jobs:
418418
working-directory: frontend
419419
run: |
420420
flutter config --enable-linux-desktop
421-
dart ./scripts/flutter_release_build/build_flowy.dart run . ${REF_NAME}
421+
dart ./scripts/flutter_release_build/build_flowy.dart run . "${REF_NAME}"
422422
423423
env:
424424
REF_NAME: ${{ github.ref_name }}
@@ -429,7 +429,7 @@ jobs:
429429
- name: Build Linux package (.deb)
430430
working-directory: frontend
431431
run: |
432-
sh scripts/linux_distribution/deb/build_deb.sh appflowy_flutter/product/${REF_NAME}/linux/Release ${REF_NAME} ${{ env.LINUX_PACKAGE_DEB_NAME }}
432+
sh scripts/linux_distribution/deb/build_deb.sh "appflowy_flutter/product/${REF_NAME}/linux"/Release ${REF_NAME} ${{ env.LINUX_PACKAGE_DEB_NAME }}
433433
434434
env:
435435
REF_NAME: ${{ github.ref_name }}
@@ -443,7 +443,7 @@ jobs:
443443
working-directory: frontend
444444
continue-on-error: true
445445
run: |
446-
sh scripts/linux_distribution/appimage/build_appimage.sh ${REF_NAME}
446+
sh scripts/linux_distribution/appimage/build_appimage.sh "${REF_NAME}"
447447
cd ..
448448
cp -r frontend/${{ env.LINUX_PACKAGE_TMP_APPIMAGE_NAME }} ${{ env.LINUX_APP_RELEASE_PATH }}/${{ env.LINUX_PACKAGE_APPIMAGE_NAME }}
449449

0 commit comments

Comments
 (0)