search

TinderSec / gh-workflow-auditor

Script to audit GitHub Action Workflow files for potential vulnerabilities.
Other
148 stars 18 forks source link

example for github.event.head_commit.author.email #6

Closed ankushgoel27 closed 2 years ago

ankushgoel27 commented 2 years ago

Hi,

I couldnt find any example as to how to leverage the code injection in ${{ github.event.head_commit.author.email }}. How is it possible to set code in your email address.

shivankar-madaan commented 2 years ago

I believe you can do this via your git cli, when committing to any branch

git config user.email "xss-payload"