Temporary fix for command injection vulnerability in GHA workflow. (#13600)
Long term fix will require writing our own action to scan the PR body, because of environment variable size limits.
Austin S. Hemmelgarn committed
Aug 31, 2022 at 14:23 UTC
0d4ff34e1a7a495d5a81355ade436af5a34b8724
1 file changed
+4
-1
.github/workflows/packaging.yml
+4
-1
@@ -41,13 +41,16 @@ jobs:
41
- name: Read build matrix
42
id: set-matrix
43
shell: python3 {0}
44
+ env:
45
+ PR_BODY: "${{ github.event.pull_request.body }}"
46
run: |
47
from ruamel.yaml import YAML
48
import json
49
import re
50
+ import os
51
FULL_CI_REGEX = '/actions run full ci'
52
ALWAYS_RUN_ARCHES = ["amd64", "x86_64"]
50
- PR_BODY = """${{ github.event.pull_request.body }}"""
53
+ PR_BODY = os.environ['PR_BODY']
54
yaml = YAML(typ='safe')
55
entries = list()
56
run_limited = False