Closed plural-renovate[bot] closed 7 months ago
Easy and customizable dashboards for your build system. Learn more about Stoat ↗︎
Name | Link | Commit | Status |
---|---|---|---|
api-coverage | Visit | 26f91584cfaedded410a8b1738ece972efc6b435 | ✅ |
rtc-coverage | Visit | 26f91584cfaedded410a8b1738ece972efc6b435 | ✅ |
core-coverage | Visit | 26f91584cfaedded410a8b1738ece972efc6b435 | ✅ |
cron-coverage | Visit | 26f91584cfaedded410a8b1738ece972efc6b435 | ✅ |
email-coverage | Visit | 26f91584cfaedded410a8b1738ece972efc6b435 | ✅ |
worker-coverage | Visit | 26f91584cfaedded410a8b1738ece972efc6b435 | ✅ |
api-test-results | Visit | 26f91584cfaedded410a8b1738ece972efc6b435 | ✅ |
graphql-coverage | Visit | 26f91584cfaedded410a8b1738ece972efc6b435 | ✅ |
rtc-test-results | Visit | 26f91584cfaedded410a8b1738ece972efc6b435 | ✅ |
core-test-results | Visit | 26f91584cfaedded410a8b1738ece972efc6b435 | ✅ |
cron-test-results | Visit | 26f91584cfaedded410a8b1738ece972efc6b435 | ✅ |
email-test-results | Visit | 26f91584cfaedded410a8b1738ece972efc6b435 | ✅ |
worker-test-results | Visit | 26f91584cfaedded410a8b1738ece972efc6b435 | ✅ |
graphql-test-results | Visit | 26f91584cfaedded410a8b1738ece972efc6b435 | ✅ |
This PR contains the following updates:
v13
->v14
GitHub Vulnerability Alerts
CVE-2023-52137
Summary
The
tj-actions/verify-changed-files
action allows for command injection in changed filenames, allowing an attacker to execute arbitrary code and potentially leak secrets.Details
The
verify-changed-files
workflow returns the list of files changed within a workflow execution.This could potentially allow filenames that contain special characters such as
;
and ` (backtick) which can be used by an attacker to take over the GitHub Runner if the output value is used in a raw fashion (thus being directly replaced before execution) inside arun
block. By running custom commands an attacker may be able to steal secrets such asGITHUB_TOKEN
if triggered on other events thanpull_request
. For example onpush
.Proof of Concept
$(whoami).txt
would be a valid filename.List all changed files tracked and untracked files
step.Example output:
Impact
This issue may lead to arbitrary command execution in the GitHub Runner.
Resolution
A new
safe_output
input would be enabled by default and return filename paths escaping special characters like ;, ` (backtick), $, (), etc for bash environments.A safe recommendation of using environment variables to store unsafe outputs.
Resources
Release Notes
tj-actions/verify-changed-files (tj-actions/verify-changed-files)
### [`v14`](https://togithub.com/tj-actions/verify-changed-files/releases/tag/v14) [Compare Source](https://togithub.com/tj-actions/verify-changed-files/compare/v13...v14) ### Changes in v14.0.2 #### What's Changed - Upgraded to v14.0.1 by [@jackton1](https://togithub.com/jackton1) in [https://github.com/tj-actions/verify-changed-files/pull/283](https://togithub.com/tj-actions/verify-changed-files/pull/283) - chore(deps): update actions/checkout action to v3.5.1 by [@renovate](https://togithub.com/renovate) in [https://github.com/tj-actions/verify-changed-files/pull/284](https://togithub.com/tj-actions/verify-changed-files/pull/284) - chore(deps): update actions/checkout action to v3.5.2 by [@renovate](https://togithub.com/renovate) in [https://github.com/tj-actions/verify-changed-files/pull/285](https://togithub.com/tj-actions/verify-changed-files/pull/285) - fix: handle new line used as separator by [@jackton1](https://togithub.com/jackton1) in [https://github.com/tj-actions/verify-changed-files/pull/287](https://togithub.com/tj-actions/verify-changed-files/pull/287) - Updated README.md by [@jackton1](https://togithub.com/jackton1) in [https://github.com/tj-actions/verify-changed-files/pull/288](https://togithub.com/tj-actions/verify-changed-files/pull/288) - fix: handle error from pipes by [@jackton1](https://togithub.com/jackton1) in [https://github.com/tj-actions/verify-changed-files/pull/289](https://togithub.com/tj-actions/verify-changed-files/pull/289) **Full Changelog**: https://github.com/tj-actions/verify-changed-files/compare/v14...v14.0.2 *** ### Changes in v14.0.1 #### What's Changed - Upgraded to v14 by [@jackton1](https://togithub.com/jackton1) in [https://github.com/tj-actions/verify-changed-files/pull/272](https://togithub.com/tj-actions/verify-changed-files/pull/272) - chore(deps): update tj-actions/verify-changed-files action to v14 by [@renovate](https://togithub.com/renovate) in [https://github.com/tj-actions/verify-changed-files/pull/273](https://togithub.com/tj-actions/verify-changed-files/pull/273) - chore(deps): update tj-actions/auto-doc action to v2.2.4 by [@renovate](https://togithub.com/renovate) in [https://github.com/tj-actions/verify-changed-files/pull/274](https://togithub.com/tj-actions/verify-changed-files/pull/274) - chore(deps): update tj-actions/auto-doc action to v2.2.5 by [@renovate](https://togithub.com/renovate) in [https://github.com/tj-actions/verify-changed-files/pull/275](https://togithub.com/tj-actions/verify-changed-files/pull/275) - chore(deps): update tj-actions/auto-doc action to v2.3.0 by [@renovate](https://togithub.com/renovate) in [https://github.com/tj-actions/verify-changed-files/pull/276](https://togithub.com/tj-actions/verify-changed-files/pull/276) - chore(deps): update actions/checkout action to v3.5.0 by [@renovate](https://togithub.com/renovate) in [https://github.com/tj-actions/verify-changed-files/pull/277](https://togithub.com/tj-actions/verify-changed-files/pull/277) - chore(deps): update tj-actions/auto-doc action to v2.3.1 by [@renovate](https://togithub.com/renovate) in [https://github.com/tj-actions/verify-changed-files/pull/278](https://togithub.com/tj-actions/verify-changed-files/pull/278) - chore(deps): update tj-actions/glob action to v16.14 by [@renovate](https://togithub.com/renovate) in [https://github.com/tj-actions/verify-changed-files/pull/279](https://togithub.com/tj-actions/verify-changed-files/pull/279) - chore(deps): update tj-actions/auto-doc action to v2.3.2 by [@renovate](https://togithub.com/renovate) in [https://github.com/tj-actions/verify-changed-files/pull/280](https://togithub.com/tj-actions/verify-changed-files/pull/280) - chore(deps): update peter-evans/create-pull-request action to v5 by [@renovate](https://togithub.com/renovate) in [https://github.com/tj-actions/verify-changed-files/pull/281](https://togithub.com/tj-actions/verify-changed-files/pull/281) - chore: update to use tj-actions/git-cliff by [@jackton1](https://togithub.com/jackton1) in [https://github.com/tj-actions/verify-changed-files/pull/282](https://togithub.com/tj-actions/verify-changed-files/pull/282) **Full Changelog**: https://github.com/tj-actions/verify-changed-files/compare/v14...v14.0.1 *** ### Changes in v14.0.0 #### 🔥 🔥 BREAKING CHANGE 🔥 🔥 - Removed the `autocrlf` input. #### What's Changed - Upgraded to v13.2.0 by [@jackton1](https://togithub.com/jackton1) in [https://github.com/tj-actions/verify-changed-files/pull/266](https://togithub.com/tj-actions/verify-changed-files/pull/266) - chore(deps): update peter-evans/create-pull-request action to v4.2.4 by [@renovate](https://togithub.com/renovate) in [https://github.com/tj-actions/verify-changed-files/pull/267](https://togithub.com/tj-actions/verify-changed-files/pull/267) - chore(deps): update actions/checkout action to v3.4.0 by [@renovate](https://togithub.com/renovate) in [https://github.com/tj-actions/verify-changed-files/pull/268](https://togithub.com/tj-actions/verify-changed-files/pull/268) - chore(deps): update tj-actions/glob action to v16.12 by [@renovate](https://togithub.com/renovate) in [https://github.com/tj-actions/verify-changed-files/pull/269](https://togithub.com/tj-actions/verify-changed-files/pull/269) - feat: remove unused core.autocrlf setting by [@jackton1](https://togithub.com/jackton1) in [https://github.com/tj-actions/verify-changed-files/pull/270](https://togithub.com/tj-actions/verify-changed-files/pull/270) - Updated README.md by [@jackton1](https://togithub.com/jackton1) in [https://github.com/tj-actions/verify-changed-files/pull/271](https://togithub.com/tj-actions/verify-changed-files/pull/271) **Full Changelog**: https://github.com/tj-actions/verify-changed-files/compare/v13...v14.0.0 ***Configuration
📅 Schedule: Branch creation - "" (UTC), Automerge - At any time (no schedule defined).
🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.
â™» Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.
🔕 Ignore: Close this PR and you won't be reminded about this update again.
This PR has been generated by Renovate Bot.