From 9e2581cbc5f25469c73fd30370372c9c2bbb1b82 Mon Sep 17 00:00:00 2001 From: Darius Cepulis Date: Wed, 4 Mar 2026 14:22:30 -0600 Subject: [PATCH] fix(ci): prevent shell injection from PR title/body in sync workflow (#711) Co-authored-by: Claude Opus 4.6 --- .github/workflows/api-reference-sync.yml | 7 +++++-- 1 file changed, 5 insertions(+), 2 deletions(-) diff --git a/.github/workflows/api-reference-sync.yml b/.github/workflows/api-reference-sync.yml index e6eeebba..5b884bec 100644 --- a/.github/workflows/api-reference-sync.yml +++ b/.github/workflows/api-reference-sync.yml @@ -36,13 +36,16 @@ jobs: - name: Set PR context id: context + env: + PR_TITLE: ${{ github.event.pull_request.title || '' }} + PR_BODY: ${{ github.event.pull_request.body || '' }} run: | echo "pr_number=${{ github.event.pull_request.number || '' }}" >> "$GITHUB_OUTPUT" - echo "pr_title=${{ github.event.pull_request.title || '' }}" >> "$GITHUB_OUTPUT" + echo "pr_title=$PR_TITLE" >> "$GITHUB_OUTPUT" echo "pr_url=${{ github.event.pull_request.html_url || '' }}" >> "$GITHUB_OUTPUT" EOF=$(dd if=/dev/urandom bs=15 count=1 status=none | base64) echo "pr_body<<$EOF" >> "$GITHUB_OUTPUT" - echo "${{ github.event.pull_request.body || '' }}" >> "$GITHUB_OUTPUT" + echo "$PR_BODY" >> "$GITHUB_OUTPUT" echo "$EOF" >> "$GITHUB_OUTPUT" - name: Check for API-relevant changes