Skip to content

Commit 33b8eb6

Browse files
mnenciamnencia
authored
fix(security): harden GitHub Actions workflows against expression injection (#121)
Move `${{ }}` expressions from `run:` blocks into step-level `env: blocks`, then reference them as properly-quoted shell variables. Signed-off-by: Marco Nenciarini <marco.nenciarini@enterprisedb.com>
1 parent 468716b commit 33b8eb6

File tree

5 files changed

+66
-35
lines changed

5 files changed

+66
-35
lines changed

‎.github/workflows/build-commitfest.yml‎

Lines changed: 15 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -38,14 +38,18 @@ jobs:
3838
3939
# Inputs have priority over defaults.json.
4040
- name: Evaluate E2E workflow inputs
41+
env:
42+
INPUT_MAJOR_VERSION: ${{ github.event.inputs.major_version }}
4143
run: |
42-
if [[ -n "${{ github.event.inputs.major_version }}" ]]; then
43-
echo "PG_MAJOR=${{ github.event.inputs.major_version }}" >> $GITHUB_ENV
44+
if [[ -n "${INPUT_MAJOR_VERSION}" ]]; then
45+
echo "PG_MAJOR=${INPUT_MAJOR_VERSION}" >> $GITHUB_ENV
4446
fi
4547
4648
- name: Set commitfest branch and tag
49+
env:
50+
INPUT_PATCH_ID: ${{ github.event.inputs.patch_id }}
4751
run: |
48-
BRANCH="cf/${{ github.event.inputs.patch_id }}"
52+
BRANCH="cf/${INPUT_PATCH_ID}"
4953
TAG="${BRANCH////-}"
5054
echo "TAG=${TAG}" >> $GITHUB_ENV
5155
echo "BRANCH=${BRANCH}" >> $GITHUB_ENV
@@ -80,8 +84,10 @@ jobs:
8084
# Get a list of the images that were built and pushed.
8185
- name: Generated images
8286
id: images
87+
env:
88+
BUILD_METADATA: ${{ steps.build.outputs.metadata }}
8389
run: |
84-
IMAGES="$(echo '${{ steps.build.outputs.metadata }}' | jq -r '.[]."image.name"')"
90+
IMAGES="$(echo "${BUILD_METADATA}" | jq -r '.[]."image.name"')"
8591
{
8692
echo 'IMAGES<<EOF'
8793
echo "${IMAGES}"
@@ -95,10 +101,13 @@ jobs:
95101
- build-pg
96102
steps:
97103
- name: Output summary
104+
env:
105+
INPUT_PATCH_ID: ${{ github.event.inputs.patch_id }}
106+
BUILD_PG_IMAGES: ${{ needs.build-pg.outputs.images }}
98107
run: |
99-
commitFestPatchID=${{ github.event.inputs.patch_id }}
108+
commitFestPatchID="${INPUT_PATCH_ID}"
100109
commitFestURL="https://commitfest.postgresql.org/patch/${commitFestPatchID}"
101-
images="${{ needs.build-pg.outputs.images }}"
110+
images="${BUILD_PG_IMAGES}"
102111
images_list="$(echo $images | tr ' ' '\n' | sed 's/^/https:\/\//')"
103112
minimalImage="$(echo $images | tr ' ' '\n' | grep minimal)"
104113

‎.github/workflows/build.yml‎

Lines changed: 12 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -44,9 +44,11 @@ jobs:
4444
4545
# Inputs have priority over defaults.json.
4646
- name: Evaluate E2E workflow inputs
47+
env:
48+
INPUT_MAJOR_VERSION: ${{ github.event.inputs.major_version }}
4749
run: |
48-
if [[ -n "${{ github.event.inputs.major_version }}" ]]; then
49-
echo "PG_MAJOR=${{ github.event.inputs.major_version }}" >> $GITHUB_ENV
50+
if [[ -n "${INPUT_MAJOR_VERSION}" ]]; then
51+
echo "PG_MAJOR=${INPUT_MAJOR_VERSION}" >> $GITHUB_ENV
5052
fi
5153
5254
- name: Log in to the GitHub Container registry
@@ -79,8 +81,10 @@ jobs:
7981
# Get a list of the images that were built and pushed.
8082
- name: Generated images
8183
id: images
84+
env:
85+
BUILD_METADATA: ${{ steps.build.outputs.metadata }}
8286
run: |
83-
IMAGES="$(echo '${{ steps.build.outputs.metadata }}' | jq -r '.[]."image.name"')"
87+
IMAGES="$(echo "${BUILD_METADATA}" | jq -r '.[]."image.name"')"
8488
{
8589
echo 'IMAGES<<EOF'
8690
echo "${IMAGES}"
@@ -94,9 +98,12 @@ jobs:
9498
- build-pg
9599
steps:
96100
- name: Output summary
101+
env:
102+
BUILD_PG_MAJOR: ${{ needs.build-pg.outputs.pg_major }}
103+
BUILD_PG_IMAGES: ${{ needs.build-pg.outputs.images }}
97104
run: |
98-
pg_major="${{ needs.build-pg.outputs.pg_major }}"
99-
images="${{ needs.build-pg.outputs.images }}"
105+
pg_major="${BUILD_PG_MAJOR}"
106+
images="${BUILD_PG_IMAGES}"
100107
images_list="$(echo $images | tr ' ' '\n' | sed 's/^/https:\/\//')"
101108
minimalImage="$(echo $images | tr ' ' '\n' | grep minimal)"
102109

‎.github/workflows/continuous-delivery.yml‎

Lines changed: 13 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -46,15 +46,19 @@ jobs:
4646
4747
# Inputs have priority over defaults.json.
4848
- name: Evaluate E2E workflow inputs
49+
env:
50+
INPUT_CNPG_BRANCH: ${{ github.event.inputs.cnpg_branch }}
51+
INPUT_TEST_DEPTH: ${{ github.event.inputs.test_depth }}
52+
INPUT_FEATURE_TYPE: ${{ github.event.inputs.feature_type }}
4953
run: |
50-
if [[ -n "${{ github.event.inputs.cnpg_branch }}" ]]; then
51-
echo "CNPG_BRANCH=${{ github.event.inputs.cnpg_branch }}" >> $GITHUB_ENV
54+
if [[ -n "${INPUT_CNPG_BRANCH}" ]]; then
55+
echo "CNPG_BRANCH=${INPUT_CNPG_BRANCH}" >> $GITHUB_ENV
5256
fi
53-
if [[ -n "${{ github.event.inputs.test_depth }}" ]]; then
54-
echo "TEST_DEPTH=${{ github.event.inputs.test_depth }}" >> $GITHUB_ENV
57+
if [[ -n "${INPUT_TEST_DEPTH}" ]]; then
58+
echo "TEST_DEPTH=${INPUT_TEST_DEPTH}" >> $GITHUB_ENV
5559
fi
56-
if [[ -n "${{ github.event.inputs.feature_type }}" ]]; then
57-
echo "FEATURE_TYPE=${{ github.event.inputs.feature_type }}" >> $GITHUB_ENV
60+
if [[ -n "${INPUT_FEATURE_TYPE}" ]]; then
61+
echo "FEATURE_TYPE=${INPUT_FEATURE_TYPE}" >> $GITHUB_ENV
5862
fi
5963
6064
- name: Log in to the GitHub Container registry
@@ -81,8 +85,10 @@ jobs:
8185
# Get a list of the images that were built and pushed. We only care about a single tag for each image.
8286
- name: Generated images
8387
id: images
88+
env:
89+
BUILD_METADATA: ${{ steps.build.outputs.metadata }}
8490
run: |
85-
echo "PG_IMAGE=$(echo '${{ steps.build.outputs.metadata }}' | jq -r '.["minimal"].["image.name"]' | grep -oP '[^,]*\d{12}[^,]*')" >> $GITHUB_ENV
91+
echo "PG_IMAGE=$(echo "${BUILD_METADATA}" | jq -r '.["minimal"].["image.name"]' | grep -oP '[^,]*\d{12}[^,]*')" >> $GITHUB_ENV
8692
8793
call-reusable-e2e:
8894
if: github.event_name == 'schedule'

‎.github/workflows/reusable-e2e.yml‎

Lines changed: 10 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -126,20 +126,23 @@ jobs:
126126

127127
# The version of operator to upgrade FROM, in the rolling upgrade E2E test
128128
- name: Retag the image to create E2E_PRE_ROLLING_UPDATE_IMG
129+
env:
130+
INPUT_MAJOR_VERSION: ${{ inputs.major_version }}
131+
INPUT_POSTGRES_IMG: ${{ inputs.postgres_img }}
129132
run: |
130-
E2E_PRE_ROLLING_UPDATE_IMG="${{ env.REGISTRY }}:${{ inputs.major_version }}-rolling-upgrade-e2e-${{ github.run_number }}"
131-
docker pull ${{ inputs.postgres_img }}
132-
docker tag ${{ inputs.postgres_img }} $E2E_PRE_ROLLING_UPDATE_IMG
133+
E2E_PRE_ROLLING_UPDATE_IMG="${REGISTRY}:${INPUT_MAJOR_VERSION}-rolling-upgrade-e2e-${GITHUB_RUN_NUMBER}"
134+
docker pull "${INPUT_POSTGRES_IMG}"
135+
docker tag "${INPUT_POSTGRES_IMG}" $E2E_PRE_ROLLING_UPDATE_IMG
133136
docker push $E2E_PRE_ROLLING_UPDATE_IMG
134137
echo "E2E_PRE_ROLLING_UPDATE_IMG=$E2E_PRE_ROLLING_UPDATE_IMG" >> $GITHUB_ENV
135138
136139
- name: Setting up defaults
137140
run: |
138141
# Exlude backup/recovery and image-volume tests
139-
if [ -z "${{ env.FEATURE_TYPE }}" ]; then
142+
if [ -z "${FEATURE_TYPE}" ]; then
140143
echo "FEATURE_TYPE=!(backup-restore || image-volume-extensions)" >> $GITHUB_ENV
141144
else
142-
echo "FEATURE_TYPE=!(backup-restore || image-volume-extensions) && ${{ env.FEATURE_TYPE }}" >> $GITHUB_ENV
145+
echo "FEATURE_TYPE=!(backup-restore || image-volume-extensions) && ${FEATURE_TYPE}" >> $GITHUB_ENV
143146
fi
144147
145148
- name: Run Kind End-to-End tests
@@ -168,12 +171,12 @@ jobs:
168171
run: |
169172
set +x
170173
python .github/generate-test-artifacts.py \
171-
-o testartifacts-${{ env.ID }} \
174+
-o "testartifacts-${ID}" \
172175
-f tests/e2e/out/report.json \
173176
--environment=true
174177
if [ -f tests/e2e/out/upgrade_report.json ]; then
175178
python .github/generate-test-artifacts.py \
176-
-o testartifacts-${{ env.ID }} \
179+
-o "testartifacts-${ID}" \
177180
-f tests/e2e/out/upgrade_report.json \
178181
--environment=true
179182
fi

‎.github/workflows/run-e2e-test.yml‎

Lines changed: 16 additions & 10 deletions
Original file line numberDiff line numberDiff line change
@@ -43,21 +43,27 @@ jobs:
4343
4444
# Inputs have priority over defaults.json.
4545
- name: Evaluate E2E workflow inputs
46+
env:
47+
INPUT_POSTGRES_IMG: ${{ github.event.inputs.postgres_img }}
48+
INPUT_MAJOR_VERSION: ${{ github.event.inputs.major_version }}
49+
INPUT_CNPG_BRANCH: ${{ github.event.inputs.cnpg_branch }}
50+
INPUT_TEST_DEPTH: ${{ github.event.inputs.test_depth }}
51+
INPUT_FEATURE_TYPE: ${{ github.event.inputs.feature_type }}
4652
run: |
47-
if [[ -n "${{ github.event.inputs.postgres_img }}" ]]; then
48-
echo "PG_IMAGE=${{ github.event.inputs.postgres_img }}" >> $GITHUB_ENV
53+
if [[ -n "${INPUT_POSTGRES_IMG}" ]]; then
54+
echo "PG_IMAGE=${INPUT_POSTGRES_IMG}" >> $GITHUB_ENV
4955
fi
50-
if [[ -n "${{ github.event.inputs.major_version }}" ]]; then
51-
echo "PG_MAJOR=${{ github.event.inputs.major_version }}" >> $GITHUB_ENV
56+
if [[ -n "${INPUT_MAJOR_VERSION}" ]]; then
57+
echo "PG_MAJOR=${INPUT_MAJOR_VERSION}" >> $GITHUB_ENV
5258
fi
53-
if [[ -n "${{ github.event.inputs.cnpg_branch }}" ]]; then
54-
echo "CNPG_BRANCH=${{ github.event.inputs.cnpg_branch }}" >> $GITHUB_ENV
59+
if [[ -n "${INPUT_CNPG_BRANCH}" ]]; then
60+
echo "CNPG_BRANCH=${INPUT_CNPG_BRANCH}" >> $GITHUB_ENV
5561
fi
56-
if [[ -n "${{ github.event.inputs.test_depth }}" ]]; then
57-
echo "TEST_DEPTH=${{ github.event.inputs.test_depth }}" >> $GITHUB_ENV
62+
if [[ -n "${INPUT_TEST_DEPTH}" ]]; then
63+
echo "TEST_DEPTH=${INPUT_TEST_DEPTH}" >> $GITHUB_ENV
5864
fi
59-
if [[ -n "${{ github.event.inputs.feature_type }}" ]]; then
60-
echo "FEATURE_TYPE=${{ github.event.inputs.feature_type }}" >> $GITHUB_ENV
65+
if [[ -n "${INPUT_FEATURE_TYPE}" ]]; then
66+
echo "FEATURE_TYPE=${INPUT_FEATURE_TYPE}" >> $GITHUB_ENV
6167
fi
6268
6369
call-reusable-e2e:

0 commit comments

Comments
 (0)