CalvinBackup/OpenAirframes
1
0
Fork 0
mirror of https://github.com/PlaneQuery/OpenAirframes.git synced 2026-09-22 05:40:44 +02:00
Code Issues Packages Projects Releases Wiki Activity

fix: pass issue body through env instead of a shell heredoc

Browse Source 
- prevent command injection from a crafted issue body closing the heredoc early
- drop the debug step that echoed untrusted input for no operational value
- read body and issue number from env in the community validation workflow

Generated-by: Claude Opus 5 <noreply@anthropic.com>
This commit is contained in:
Ashley Childress
2026-08-31 17:46:41 -04:00
parent 2829e5fb6e
commit f228d16c60
1 changed files with 6 additions and 13 deletions
Download Patch File Download Diff File Expand all files Collapse all files
.github/workflows/validate-community-submission.yaml
+6 -13
View File
@@ -23,24 +23,17 @@ jobs:
- name: Install dependencies - name: Install dependencies
run: pip install jsonschema run: pip install jsonschema
- name: Debug issue body
run: |
echo "=== Issue Body ==="
cat << 'ISSUE_BODY_EOF'
${{ github.event.issue.body }}
ISSUE_BODY_EOF
- name: Save issue body to file - name: Save issue body to file
run: | env:
cat << 'ISSUE_BODY_EOF' > /tmp/issue_body.txt ISSUE_BODY: ${{ github.event.issue.body }}
${{ github.event.issue.body }} run: printf '%s' "$ISSUE_BODY" > "$RUNNER_TEMP/issue_body.txt"
ISSUE_BODY_EOF
- name: Validate submission - name: Validate submission
env: env:
GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
GITHUB_REPOSITORY: ${{ github.repository }} GITHUB_REPOSITORY: ${{ github.repository }}
ISSUE_NUMBER: ${{ github.event.issue.number }}
run: | run: |
python -m src.contributions.validate_submission \ python -m src.contributions.validate_submission \
--issue-body-file /tmp/issue_body.txt \ --issue-body-file "$RUNNER_TEMP/issue_body.txt" \
--issue-number ${{ github.event.issue.number }} --issue-number "$ISSUE_NUMBER"