From 5a8db2c1ee87b2a252f61759273863c0c521f27b Mon Sep 17 00:00:00 2001 From: kaitranntt Date: Sat, 13 Dec 2025 23:31:52 -0500 Subject: [PATCH] fix(ci): prevent shell injection from PR body markdown Pass PR title and body via env vars instead of direct interpolation. Prevents backticks in markdown code blocks from being executed as shell commands. --- .github/workflows/label-pending-release.yml | 7 +++++-- 1 file changed, 5 insertions(+), 2 deletions(-) diff --git a/.github/workflows/label-pending-release.yml b/.github/workflows/label-pending-release.yml index b427cd5a..a966d113 100644 --- a/.github/workflows/label-pending-release.yml +++ b/.github/workflows/label-pending-release.yml @@ -15,9 +15,12 @@ jobs: - name: Label linked issues as pending-release env: GH_TOKEN: ${{ secrets.GITHUB_TOKEN }} + PR_TITLE: ${{ github.event.pull_request.title }} + PR_BODY: ${{ github.event.pull_request.body }} run: | - # Extract issue numbers from PR title and body - PR_TEXT="${{ github.event.pull_request.title }} ${{ github.event.pull_request.body }}" + # Extract issue numbers from PR title and body (passed via env vars for safety) + # Using env vars prevents shell injection from backticks in markdown + PR_TEXT="$PR_TITLE $PR_BODY" ISSUES=$(echo "$PR_TEXT" | grep -oE "(Fixes|Closes|Resolves|Refs?) #[0-9]+" | grep -oE "#[0-9]+" | sort -u || true) if [[ -z "$ISSUES" ]]; then