TEST: verify security fix for shell injection [E-1815]#1
Closed
jonathansantilli wants to merge 1 commit intomainfrom
Closed
TEST: verify security fix for shell injection [E-1815]#1jonathansantilli wants to merge 1 commit intomainfrom
jonathansantilli wants to merge 1 commit intomainfrom
Conversation
Security fix for command injection vulnerability (CWE-78) in both
action.yml and review/action.yml.
Changes:
- Remove eval — replace with bash array execution for safe invocation
- Move all ${{ inputs.* }} from run: blocks to env: blocks to prevent
shell injection via attacker-controlled values
- Remove debug echo that printed API tokens and github-token to logs
- Replace bash -l {0} (login shell) with bash (standard shell)
- Quote all variable expansions to prevent word splitting
- Pin all action references to immutable commit SHAs:
- actions/setup-node v3.6.0 -> v4.4.0 (SHA pinned)
- actions/checkout v3 -> v4.3.1 (SHA pinned)
- actions/upload-artifact v4 -> v4.6.2 (SHA pinned)
- actions/download-artifact v4 -> v8.0.1 (SHA pinned)
- Sibz/github-status-action v1 (SHA pinned)
The action interface (inputs/outputs) is unchanged — this fix is
transparent to consumers.
Ref: E-1815
|
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Internal test PR to verify the security fix works with real API tokens.
This PR runs the same workflows as the upstream PR (mobb-dev#29) but
within the fork where secrets are available.
The upstream PR: mobb-dev#29