From 6139dd42149600ac6c04f09981f63d31d0993db9 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Ond=C5=99ej=20Budai?= <ondrej@budai.cz>
Date: Tue, 3 Dec 2024 15:28:31 +0100
Subject: [PATCH] github: prevent script injections via PR branch names
Prior this commit, ${{ github.event.workflow_run.head_branch }} got
expanded in the bash script. A malicious actor could inject
an arbitrary shell script. Since this action has access to a token
with write rights the malicious actor can easily steal this token.
This commit moves the expansion into an env block where such an
injection cannot happen. This is the preferred way according to the
github docs:
https://docs.github.com/en/actions/security-guides/security-hardening-for-github-actions#using-an-intermediate-environment-variable
---
.github/workflows/trigger-gitlab.yml | 4 +++-
1 file changed, 3 insertions(+), 1 deletion(-)
diff --git a/.github/workflows/trigger-gitlab.yml b/.github/workflows/trigger-gitlab.yml
index 97a0a73d..096f0e3d 100644
--- a/.github/workflows/trigger-gitlab.yml
+++ b/.github/workflows/trigger-gitlab.yml
@@ -36,6 +36,8 @@ jobs:
route: GET /repos/${{ github.repository }}/pulls
- name: Checkout branch
+ env:
+ BRANCH: ${{ github.event.workflow_run.head_branch }}
# yamllint disable rule:line-length
run: |
PR_DATA=$(mktemp)
@@ -48,7 +50,7 @@ jobs:
if [ ! -z "$PR" ]; then
git checkout -b PR-$PR
else
- git checkout ${{ github.event.workflow_run.head_branch }} --
+ git checkout "${BRANCH}" --
fi
# yamllint enable rule:line-length