RELEASE @W-19079373@ Prevent PR title injection in validate-pr workflow - #2079
Conversation
Hardens the validate-pr GitHub Actions workflow against PR-title script
injection (CWE-94) by passing the untrusted PR title and base ref through
environment variables instead of inline ${{ }} interpolation, and adds a
least-privilege 'permissions: contents: read' block.
CI-only change (.github/workflows/validate-pr.yml); no runtime/package
changes. Port of the fix already merged to dev (#2077) onto main.
Fixes W-19079373.
There was a problem hiding this comment.
@nikhil-mittal-165 Can we apply the fix to head_ref as well ?
Extends the PR-title injection hardening to the branch-ref checks: passes
github.head_ref through an env var (HEAD_REF) and replaces the two inline
${{ startsWith(...) }} expressions with shell glob matches (== m2d/* and
== release-*). This removes the last ${{ }} interpolations from the run
block so all untrusted inputs are handled uniformly as data.
Behavior is unchanged; verified the glob matches are equivalent to the
prior startsWith() checks. Addresses review feedback on #2079.
aruntyagiTutu
left a comment
aruntyagiTutu
left a comment
There was a problem hiding this comment.
Port of the already-reviewed/approved PR-title-injection fix (dev #2077) onto main, targeting the RELEASE branch per the RELEASE @W-XXXXXXXX@ title convention. Diff matches the dev fix exactly — untrusted PR_TITLE/BASE_REF (and now also HEAD_REF, added in a small follow-up commit) passed via env: instead of ${{ }} interpolation in the run: script, plus the startsWith(...) calls replaced with a plain bash glob match on the now-env-sourced head_ref/base_ref — correctly removes the last two ${{ }} uses inside the script body entirely. Least-privilege permissions: contents: read included. CI-only change, no runtime/package impact. CI green across all checks. Approving.
3 participants
Hardens the validate-pr GitHub Actions workflow against PR-title script injection (CWE-94) by passing the untrusted PR title and base ref through environment variables instead of inline ${{ }} interpolation, and adds a least-privilege 'permissions: contents: read' block.
CI-only change (.github/workflows/validate-pr.yml); no runtime/package changes. Port of the fix already merged to dev (#2077) onto main.
Fixes W-19079373.