Fix code injection warnings in check-codescanning-config internal Action - #2781
angelapwen merged 8 commits into
Conversation
Sorry, something went wrong.
`runner.temp` is not user-controlled but we replace it with `$RUNNER_TEMP` in any case.
There was a problem hiding this comment.
PR Overview
This PR fixes code injection warnings in the check-codescanning-config Action by switching to environment variables and safer temporary directory references.
- Replace user-supplied inline inputs with environment variables for improved security.
- Update temporary directory references to use $RUNNER_TEMP.
Reviewed Changes
| File | Description |
|---|---|
| .github/actions/check-codescanning-config/action.yml | Updated to use environment variable EXPECTED_CONFIG_FILE_CONTENTS and $RUNNER_TEMP for file paths in commands and cleanup steps. |
Copilot reviewed 1 out of 1 changed files in this pull request and generated 1 comment.
Tip: If you use Visual Studio Code, you can request a review from Copilot before you push from the "Source Control" tab. Learn more
Sorry, something went wrong.
aeisenberg
left a comment
There was a problem hiding this comment.
See copilot's comment.
Sorry, something went wrong.
Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>
|
Oh...now it looks like the tests need to be updated. I'm not sure if this is a semantic change or just some artifact of how the quoting has changed. |
Sorry, something went wrong.
|
Hrm.. looks like the "{}" input is now being parsed as undefined. Let me try to debug.. |
Sorry, something went wrong.
|
Okay, figured it out... I had declared the environment variable in the wrong block 🤦 |
Sorry, something went wrong.
Merge / deployment checklist