Fix: GitHub workflow script injection

googleapis / go-genproto

Generated code for Google Cloud client libraries.

https://pkg.go.dev/google.golang.org/genproto

Apache License 2.0

591 stars 188 forks source link

Fix: GitHub workflow script injection #1169

Closed joycebrum closed 5 days ago

joycebrum commented 5 days ago

Hi! Joyce from Google's Open Source Security Team (GOSST) here. This PR prevents script injection in your GitHub workflows by parsing github.event.pull_request.head.ref into an environment variable before use.

More info on this threat: Keeping your GitHub Actions and workflows secure Part 2: Untrusted input.

Any questions, let me know!

Thanks!