skills/angular__angular
1
0
Fork 0
mirror of https://github.com/angular/angular.git synced 2026-09-14 13:54:52 +08:00
Code Issues Packages Projects Releases Wiki Activity

ci: harden workflow against expression injection

Browse Source 
Interpolating GitHub context values directly into `run:` steps creates
an expression-injection vector. Move the affected values into an `env:`
block and reference them as environment variables in the shell script
instead. This prevents shell metacharacters in context values from
altering step behaviour.

Signed-off-by: El Mehdi Abenhazou <mehdiananas007@gmail.com>
This commit is contained in:
XananasX7
2026-06-13 16:25:35 +00:00
committed by Matthew Beck
parent 2e32872720
commit d43acaf80c
1 changed files with 4 additions and 4 deletions
Download Patch File Download Diff File Expand all files Collapse all files
.github/workflows/benchmark-compare.yml
+4 -4
View File
@@ -63,12 +63,12 @@ jobs:
COMMENT_BODY: ${{ github.event.comment.body }}
run: pnpm benchmarks prepare-for-github-action "$COMMENT_BODY"
- run: pnpm benchmarks run-compare "$COMPARE_SHA" "$BENCHMARK_TARGET"
- env:
COMPARE_SHA: ${{steps.info.outputs.compareSha}}
BENCHMARK_TARGET: ${{steps.info.outputs.benchmarkTarget}}
run: pnpm benchmarks run-compare "$COMPARE_SHA" "$BENCHMARK_TARGET"
id: benchmark
name: Running benchmark
env:
BENCHMARK_TARGET: ${{steps.info.outputs.benchmarkTarget}}
COMPARE_SHA: ${{steps.info.outputs.compareSha}}
- uses: peter-evans/create-or-update-comment@e8674b075228eee787fea43ef493e45ece1004c9 # v5
with: