search

ludeeus / action-shellcheck

GitHub action for ShellCheck.
MIT License
292 stars 69 forks source link

Pass inputs to env before reading #66

Closed dotboris closed 1 year ago

dotboris commented 2 years ago

👋 Hello there. My organization's security team has found that this GitHub action is vulnerable to script injection. This kind of vulnerability is described here: https://docs.github.com/en/actions/security-guides/security-hardening-for-github-actions#understanding-the-risk-of-script-injections

The issue is present because GitHub expressions (${{ ... }}) are used inside run: ... values. If uncontrolled user input is passes in to this action, it would allow an attacker to inject a shell script and execute arbitrary code. The exploitability of this issue depends entire on how users of this action call it. To avoid any potential vulnerabilities for users of this action, I have fixed all script injection issues.

The fix consists of using intermediary environment variables. This ensures that the usual shell variable quoting rules apply correctly and no input can be interpreted as code by bash.

ludeeus commented 2 years ago

A conflict appeared and CI is failing.

dotboris commented 2 years ago

@ludeeus I have fixed the merge conflicts. I believe that I need your approval for the CI to run so that I can figure if it's still breaking and why.

dotboris commented 2 years ago

@ludeeus I believe that I've fixed all the CI issues. I tested locally and everything worked as expected. I'll need your approval to run the CI again.