zoriya/v10
1
0
Fork 0
mirror of https://github.com/zoriya/v10.git synced 2026-08-06 06:07:56 +00:00
Code Issues Packages Projects Releases Wiki Activity

fix(ci): prevent shell injection from PR title/body in sync workflow (#711)

Browse Source 
Co-authored-by: Claude Opus 4.6 <noreply@anthropic.com>
This commit is contained in:
Darius Cepulis
2026-03-04 14:22:30 -06:00
committed by GitHub
co-authored by Claude Opus 4.6
parent 4e1f3af2d7
commit 9e2581cbc5
1 changed files with 5 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files
.github/workflows/api-reference-sync.yml
+5 -2
View File
@@ -36,13 +36,16 @@ jobs:
- name: Set PR context
id: context
env:
PR_TITLE: ${{ github.event.pull_request.title || '' }}
PR_BODY: ${{ github.event.pull_request.body || '' }}
run: |
echo "pr_number=${{ github.event.pull_request.number || '' }}" >> "$GITHUB_OUTPUT"
echo "pr_title=${{ github.event.pull_request.title || '' }}" >> "$GITHUB_OUTPUT"
echo "pr_title=$PR_TITLE" >> "$GITHUB_OUTPUT"
echo "pr_url=${{ github.event.pull_request.html_url || '' }}" >> "$GITHUB_OUTPUT"
EOF=$(dd if=/dev/urandom bs=15 count=1 status=none | base64)
echo "pr_body<<$EOF" >> "$GITHUB_OUTPUT"
echo "${{ github.event.pull_request.body || '' }}" >> "$GITHUB_OUTPUT"
echo "$PR_BODY" >> "$GITHUB_OUTPUT"
echo "$EOF" >> "$GITHUB_OUTPUT"
- name: Check for API-relevant changes