Commit 51e6422
authored
fix: prevent template injection in run: steps (VULN-1652) (#1947)
Replace direct ${{ inputs.skip_validation }}, ${{ inputs.use_oidc }},
${{ inputs.token }}, and ${{ env.CODECOV_TOKEN }} interpolation inside
run: shell scripts with env-var indirection. GitHub Actions resolves
template expressions before the shell sees the script, so any consumer
workflow that passes user-controlled data into these inputs could
achieve arbitrary command execution on the runner. Moving the values
into env: entries and referencing them as $INPUT_* shell variables
ensures the shell always treats them as data, not code.1 parent 57e3a13 commit 51e6422
1 file changed
Lines changed: 11 additions & 6 deletions
| Original file line number | Diff line number | Diff line change | |
|---|---|---|---|
@@ -177,6 +177,8 @@ runs: | |||
| 177 | 177 | steps: | |
| 178 | 178 | - name: Check system dependencies | |
| 179 | 179 | shell: sh | |
| 180 | + env: | ||
| 181 | + INPUT_SKIP_VALIDATION: ${{ inputs.skip_validation }} | ||
| 180 | 182 | run: | | |
| 181 | 183 | missing_deps="" | |
| 182 | 184 | ||
@@ -188,7 +190,7 @@ runs: | |||
| 188 | 190 | done | |
| 189 | 191 | ||
| 190 | 192 | # Check for gpg only if validation is not being skipped | |
| 191 | - if [ "${{ inputs.skip_validation }}" != "true" ]; then | ||
| 193 | + if [ "$INPUT_SKIP_VALIDATION" != "true" ]; then | ||
| 192 | 194 | if ! command -v gpg >/dev/null 2>&1; then | |
| 193 | 195 | missing_deps="$missing_deps gpg" | |
| 194 | 196 | fi | |
@@ -245,24 +247,27 @@ runs: | |||
| 245 | 247 | - name: Get and set token | |
| 246 | 248 | shell: bash | |
| 247 | 249 | run: | | |
| 248 | - if [ "${{ inputs.use_oidc }}" == 'true' ] && [ "$CC_FORK" != 'true' ]; | ||
| 250 | + if [ "$INPUT_USE_OIDC" == 'true' ] && [ "$CC_FORK" != 'true' ]; | ||
| 249 | 251 | then | |
| 250 | 252 | echo "CC_TOKEN=$CC_OIDC_TOKEN" >> "$GITHUB_ENV" | |
| 251 | - elif [ -n "${{ env.CODECOV_TOKEN }}" ]; | ||
| 253 | + elif [ -n "$INPUT_CODECOV_TOKEN" ]; | ||
| 252 | 254 | then | |
| 253 | 255 | echo -e "\033[0;32m==>\033[0m Token set from env" | |
| 254 | - echo "CC_TOKEN=${{ env.CODECOV_TOKEN }}" >> "$GITHUB_ENV" | ||
| 256 | + echo "CC_TOKEN=$INPUT_CODECOV_TOKEN" >> "$GITHUB_ENV" | ||
| 255 | 257 | else | |
| 256 | - if [ -n "${{ inputs.token }}" ]; | ||
| 258 | + if [ -n "$INPUT_TOKEN" ]; | ||
| 257 | 259 | then | |
| 258 | 260 | echo -e "\033[0;32m==>\033[0m Token set from input" | |
| 259 | - CC_TOKEN=$(echo "${{ inputs.token }}" | tr -d '\n') | ||
| 261 | + CC_TOKEN=$(echo "$INPUT_TOKEN" | tr -d '\n') | ||
| 260 | 262 | echo "CC_TOKEN=$CC_TOKEN" >> "$GITHUB_ENV" | |
| 261 | 263 | fi | |
| 262 | 264 | fi | |
| 263 | 265 | env: | |
| 264 | 266 | CC_OIDC_TOKEN: ${{ steps.oidc.outputs.result }} | |
| 265 | 267 | CC_OIDC_AUDIENCE: ${{ inputs.url || 'https://codecov.io' }} | |
| 268 | + INPUT_USE_OIDC: ${{ inputs.use_oidc }} | ||
| 269 | + INPUT_TOKEN: ${{ inputs.token }} | ||
| 270 | + INPUT_CODECOV_TOKEN: ${{ env.CODECOV_TOKEN }} | ||
| 266 | 271 | ||
| 267 | 272 | - name: Override branch for forks | |
| 268 | 273 | shell: bash | |
0 commit comments