GH secretes can be returned in notifications

Miker91 commented 1 year ago

Hi,

Secrets should not be parsed and returned in the notifications. People may want to use this action having organization-wide secretes which should not be returned in clear text.

Example:

      - uses: actions/checkout@master
      - name: Microsoft Teams Notification
        uses: skitionek/notify-microsoft-teams@master
        if: always()
        with:
          webhook_url: ${{ secrets.MS_TEAMS_WEBHOOK_URI }}
          overwrite: "{title: `Overwrote title in ${{ secrets.MS_TEAMS_WEBHOOK_URI }}`}"

Result:

Skitionek commented 1 year ago

Good point - will take a look into it

oxc commented 1 year ago

I don't think the secrets are evaluated by the eval call. They are already evaluated as part of the overwrite value by GitHub Actions. You need to escape the ${{...}}} in your yaml expression.

Having said that, I guess the eval can leak undesired properties. I would go for a more explicit way to replace the variables you want to support, something like this (untested):

  overwrite.replaceAll(/\$\{(\W+)\}/, (varName) => switch (varName) { 
    case 'workflow_link': return workflow_link
    ...
  });

or

  const vars = { workflow_link, ... };
  overwite.replaceAll(new Regexp(`\$\{(${Object.keys(vars).join('|')})\}`), (varName) => vars[varName]);

copdips commented 9 months ago

@Miker91 @Skitionek I dont see such bug as of now, maybe the bug has been fixed, would you confirm ?

Skitionek / notify-microsoft-teams

GH secretes can be returned in notifications #38