From 9ac493f31dcdf3aa8fd12d92ae20c5c289766f1a Mon Sep 17 00:00:00 2001 From: Nikhil Mittal Date: Tue, 11 Aug 2026 18:54:34 +0530 Subject: [PATCH] FIX @W-19079373@ Prevent PR title injection in validate-pr workflow The validate-pr workflow interpolated the attacker-controlled github.event.pull_request.title directly into run: shell scripts, allowing script injection via a crafted PR title. Pass the title through an environment variable (treated as data, not code) and add a least-privilege permissions block (contents: read). --- .github/workflows/verify-pr.yml | 17 +++++++++++++++-- 1 file changed, 15 insertions(+), 2 deletions(-) diff --git a/.github/workflows/verify-pr.yml b/.github/workflows/verify-pr.yml index fe441410..7da59072 100644 --- a/.github/workflows/verify-pr.yml +++ b/.github/workflows/verify-pr.yml @@ -3,6 +3,11 @@ on: pull_request: types: [edited, opened, reopened, synchronize] +# Principle of least privilege: this workflow only needs to read repository +# contents. Restricting the token limits the blast radius of any compromised step. +permissions: + contents: read + defaults: run: shell: bash @@ -13,8 +18,12 @@ jobs: steps: - name: Validate PR Title if: github.base_ref == 'dev' + # Pass the untrusted PR title via the environment (not direct ${{ }} + # interpolation) so it is treated as data and cannot inject shell commands. + env: + PR_TITLE: ${{ github.event.pull_request.title }} run: | - title="${{ github.event.pull_request.title }}" + title="$PR_TITLE" if [[ "$title" =~ ^(POSTRELEASE|FIX|CHANGE|NEW)([[:space:]]*\([^()]+\))?[[:space:]]*:?[[:space:]]*@W-[[:digit:]]{8,9}@[[:space:]]*.+ ]]; then echo "Valid PR title: '$title'" else @@ -29,8 +38,12 @@ jobs: - name: Check for "Postrelease" keyword in PR title. id: main if: github.base_ref == 'dev' + # Pass the untrusted PR title via the environment (not direct ${{ }} + # interpolation) so it is treated as data and cannot inject shell commands. + env: + PR_TITLE: ${{ github.event.pull_request.title }} run: | - title="${{ github.event.pull_request.title }}" + title="$PR_TITLE" if [[ "$title" =~ ^POSTRELEASE ]]; then echo "is_postrelease=true" >> "$GITHUB_OUTPUT" else