fix(helm): Avoid forbidden chars in annotation

[kiblik]

Fix GHA error in https://github.com/DefectDojo/django-DefectDojo/actions/runs/19437653457/job/55612682248?pr=13726

[dryrunsecurity]

This pull request contains a command-injection risk in the GitHub Actions workflow (.github/workflows/test-helm-chart.yml): the PR title is incompletely sanitized before being used in a shell command, allowing an attacker to include metacharacters (e.g., ;, `, $, quotes, parentheses) in a title to execute arbitrary commands in the runner (e.g., "test; echo pwned").

Command Injection in .github/workflows/test-helm-chart.yml

Vulnerability

Command Injection

Description

The GitHub Actions workflow attempts to sanitize the pull request title before using it in a shell command. However, the sanitization is incomplete, as it does not remove critical shell metacharacters such as spaces, single quotes, double quotes, backslashes, dollar signs, parentheses, semicolons, or backticks. An attacker can craft a malicious pull request title containing these characters to inject arbitrary shell commands, which will be executed by the yq command within the GitHub Actions runner. For example, a title like test; echo pwned would execute echo pwned.

django-DefectDojo/.github/workflows/test-helm-chart.yml

Lines 122 to 125 in 99e24c4

	yq -i '.annotations."artifacthub.io/changes" += "- kind: changed\n description: $title\n"' helm/defectdojo/Chart.yaml
	git add helm/defectdojo/Chart.yaml
	git commit -m "ci: update Chart annotations from PR #${{ github.event.pull_request.number }}" || echo "No changes to commit"

---

All finding details can be found in the DryRun Security Dashboard.

[mtesauro]

Approved