woodruffw / zizmor

A tool for finding security issues in GitHub Actions setups.
https://crates.io/crates/zizmor
MIT License
64 stars 2 forks source link

Fix expression extraction #25

Closed woodruffw closed 1 month ago

woodruffw commented 1 month ago

utils::iter_expressions doesn't work as expected, both because it's greedy (since it uses regexps under the hood) and because it's insufficiently context sensitive (e.g. doesn't understand that ${{ '${{ ... }}' }} is a single expression).

It should be a real parser instead.