Fix expression injection in composite actions - #6
Merged
Merged
Conversation
Move ${{ inputs.* }} from run: blocks to env: blocks so values are
set as environment variables before bash executes. Prevents shell
injection via crafted input values on user-submitted PRs.
Resolves CodeQL alerts 1–4 (actions/code-injection).
Move ${{ inputs.* }} from run: blocks to env: blocks so values are
set as environment variables before bash executes. Prevents shell
injection via crafted input values on user-submitted PRs.
Resolves CodeQL alerts 5–10 (actions/code-injection).
github-actions
Bot
added
bug
There was a problem hiding this comment.
Pull request overview
This PR hardens the repo’s composite GitHub Actions (rubric-check and surface-compat) against expression/shell injection by removing direct ${{ inputs.* }} interpolation from run: scripts and passing those values via env: instead. This is particularly important because these actions are used in workflows that execute on untrusted PRs in downstream *-cli repositories.
Changes:
- Moved
inputs.cli-binary,inputs.baseline, andinputs.profileusage out ofrun:blocks into stepenv:blocks in both actions. - Updated bash scripts to reference the environment variables (e.g.,
$INPUT_CLI_BINARY,$INPUT_BASELINE,$INPUT_PROFILE) instead of inline expressions.
Reviewed changes
Copilot reviewed 2 out of 2 changed files in this pull request and generated 3 comments.
| File | Description |
|---|---|
| actions/surface-compat/action.yml | Uses env: variables for cli-binary and baseline to avoid input interpolation inside bash scripts. |
| actions/rubric-check/action.yml | Uses env: variables for cli-binary and profile to avoid input interpolation inside bash scripts. |
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
Workflow commands (::error::, ::warning::) are vulnerable to newline injection when they include user-controlled values. Replace with plain stderr messages to eliminate the command injection vector.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
${{ inputs.* }}interpolations fromrun:blocks toenv:blocks in bothrubric-checkandsurface-compatcomposite actionsThese actions are consumed by our
*-clirepos, where workflows run on user-submitted PRs. A malicious PR author could craft input values containing shell metacharacters that break out of the interpolation context. Theenv:pattern eliminates this class entirely.Resolves all 10 CodeQL
actions/code-injectionalerts (1–10).Test plan
make checkpassesgrepconfirms no${{ inputs.remains in anyrun:block