ci: fix expression injection in pr-target-branch.yml#19095
Open
XananasX7 wants to merge 1 commit into
Open
Conversation
The debug step passed github.event.pull_request.base.ref directly
into a shell echo command:
run: echo Target is ${{ github.event.pull_request.base.ref }}
A base branch name containing shell metacharacters would cause
unintended command execution or output corruption.
Fix: move the value into a BASE_REF env: variable and echo it as
a quoted ${BASE_REF} string.
No behaviour change is intended.
Contributor
|
Thanks so much for the pull request! |
telegraf-tiger
Bot
added
the
ci
Author
|
!signed-cla — I've signed the InfluxData CLA at https://www.influxdata.com/legal/cla/ using mehdiananas007@gmail.com. Please let me know if there's anything else needed to unblock the review. Thank you! |
Member
|
@XananasX7 for the CLA you need to use the same email you use for your Github account... |
Member
|
!signed-cla |
Member
|
@XananasX7 please also restore the PR description template, especially the AI part and fill it in as we cannot review the PR otherwise... |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
The debug step in pr-target-branch.yml passed
github.event.pull_request.base.ref directly into a shell command:
run: echo Target is ${{ github.event.pull_request.base.ref }}
A pull request whose base branch name contains shell metacharacters
(semicolon, backtick, dollar-parenthesis, quotes, etc.) could cause
unintended command execution or output corruption in the runner.
Fix: move the value into a BASE_REF env: variable at the step level
and reference it as "${BASE_REF}" in the shell command.
This follows the safe interpolation pattern from GitHub's security
hardening for GitHub Actions guide.
No behaviour change is intended.