github actions yaml files vulnerable to script injections corrected

optimizely · Sep 23, 2024 · adf452f · adf452f
1 parent 50533a9
commit adf452f
Show file tree

Hide file tree

Showing 2 changed files with 11 additions and 8 deletions.
diff --git a/.github/workflows/csharp_release.yml b/.github/workflows/csharp_release.yml
@@ -15,8 +15,7 @@ jobs:
       - name: Set semantic version variable
         id: set_version
         run: |
-          TAG=${{ env.TAG }}
-          SEMANTIC_VERSION=$(echo "${TAG}" | grep -Po "(?<=^|[^0-9])([0-9]+\.[0-9]+\.[0-9]+(\.[0-9]+)?(-[a-zA-Z]+[0-9]*)?)")
+          SEMANTIC_VERSION=$(echo "$TAG" | grep -Po "(?<=^|[^0-9])([0-9]+\.[0-9]+\.[0-9]+(\.[0-9]+)?(-[a-zA-Z]+[0-9]*)?)")
           if [ -z "${SEMANTIC_VERSION}" ]; then
             echo "Tag did not start with a semantic version number (e.g., #.#.#; #.#.#.#; #.#.#.#-beta)"
             exit 1
@@ -25,10 +24,10 @@ jobs:
       - name: Output tag & semantic version
         id: outputs
         run: |
-          echo ${{ env.TAG }}
+          echo "$TAG"
           echo ${{ steps.set_version.outputs.semantic_version }}
     outputs:
-      tag: ${{ env.TAG }}
+      tag: $TAG
       semanticVersion: ${{ steps.set_version.outputs.semantic_version }}
 
   buildFrameworkVersions:

diff --git a/.github/workflows/integration_test.yml b/.github/workflows/integration_test.yml
@@ -23,15 +23,19 @@ jobs:
         path: 'home/runner/travisci-tools'
         ref: 'master'
     - name: set SDK Branch if PR
+      env: 
+        HEAD_REF: ${{ github.head_ref }}
       if: ${{ github.event_name == 'pull_request' }}
       run: |
-        echo "SDK_BRANCH=${{ github.head_ref }}" >> $GITHUB_ENV
-        echo "TRAVIS_BRANCH=${{ github.head_ref }}" >> $GITHUB_ENV
+        echo "SDK_BRANCH=$HEAD_REF" >> $GITHUB_ENV
+        echo "TRAVIS_BRANCH=$HEAD_REF" >> $GITHUB_ENV
     - name: set SDK Branch if not pull request
+      env:
+        REF_NAME: ${{ github.ref_name }}
       if: ${{ github.event_name != 'pull_request' }}
       run: |
-        echo "SDK_BRANCH=${{ github.ref_name }}" >> $GITHUB_ENV
-        echo "TRAVIS_BRANCH=${{ github.ref_name }}" >> $GITHUB_ENV
+        echo "SDK_BRANCH=$REF_NAME" >> $GITHUB_ENV
+        echo "TRAVIS_BRANCH=$REF_NAME" >> $GITHUB_ENV
     - name: Trigger build
       env:
         SDK: csharp