Skip to content

chore: sanitize github actions workflows#89

Merged
surekhaw merged 2 commits intodevelopfrom
input-validation
Feb 20, 2026
Merged

chore: sanitize github actions workflows#89
surekhaw merged 2 commits intodevelopfrom
input-validation

Conversation

@surekhaw
Copy link
Contributor

@surekhaw surekhaw commented Feb 12, 2026

Description

  • Add input validation for workflow inputs
  • Improve shell script safety with proper quoting
  • Enhance error handling in CI/CD scripts

Screenshots

N/A

Testing instructions

N/A

@github-actions
Copy link
Contributor

Code Coverage

Total Project Coverage 70.78%

Copy link
Collaborator

@surrsurus surrsurus left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I followed the steps in the LIs associated with this PR and ran the RCE and was able to verify that we indeed are able to validate the inputs with this change:

Image Image
ERROR: Invalid version format: 
Version must match semantic versioning format (e.g., 1.2.3, 1.2.3-beta)

@surekhaw surekhaw marked this pull request as ready for review February 12, 2026 21:45
@mgriepentrog
Copy link

It looks like the validation works, but the contents of /etc/passwd are still being printed. GitHub recommends using an intermediate environment variable to mitigate against this class of attack: https://docs.github.com/en/actions/reference/security/secure-use#use-an-intermediate-environment-variable.

Copy link

@mgriepentrog mgriepentrog left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Verified input is being sanitized.
Image

@surekhaw surekhaw merged commit 7adcd62 into develop Feb 20, 2026
17 of 18 checks passed
@surekhaw surekhaw deleted the input-validation branch February 20, 2026 22:44
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

3 participants