From adf452fd4e3ed99f408a5d46c6c80a24b660d359 Mon Sep 17 00:00:00 2001
From: FarhanAnjum-opti <farhan.anjum@optimizely.com>
Date: Mon, 23 Sep 2024 20:27:22 +0600
Subject: [PATCH] github actions yaml files vulnerable to script injections
 corrected

---
 .github/workflows/csharp_release.yml   |  7 +++----
 .github/workflows/integration_test.yml | 12 ++++++++----
 2 files changed, 11 insertions(+), 8 deletions(-)

diff --git a/.github/workflows/csharp_release.yml b/.github/workflows/csharp_release.yml
index 90e680a7..8f989fc6 100644
--- a/.github/workflows/csharp_release.yml
+++ b/.github/workflows/csharp_release.yml
@@ -15,8 +15,7 @@ jobs:
       - name: Set semantic version variable
         id: set_version
         run: |
-          TAG=${{ env.TAG }}
-          SEMANTIC_VERSION=$(echo "${TAG}" | grep -Po "(?<=^|[^0-9])([0-9]+\.[0-9]+\.[0-9]+(\.[0-9]+)?(-[a-zA-Z]+[0-9]*)?)")
+          SEMANTIC_VERSION=$(echo "$TAG" | grep -Po "(?<=^|[^0-9])([0-9]+\.[0-9]+\.[0-9]+(\.[0-9]+)?(-[a-zA-Z]+[0-9]*)?)")
           if [ -z "${SEMANTIC_VERSION}" ]; then
             echo "Tag did not start with a semantic version number (e.g., #.#.#; #.#.#.#; #.#.#.#-beta)"
             exit 1
@@ -25,10 +24,10 @@ jobs:
       - name: Output tag & semantic version
         id: outputs
         run: |
-          echo ${{ env.TAG }}
+          echo "$TAG"
           echo ${{ steps.set_version.outputs.semantic_version }}
     outputs:
-      tag: ${{ env.TAG }}
+      tag: $TAG
       semanticVersion: ${{ steps.set_version.outputs.semantic_version }}
   
   buildFrameworkVersions:
diff --git a/.github/workflows/integration_test.yml b/.github/workflows/integration_test.yml
index 423e2dfe..cf9a96b3 100644
--- a/.github/workflows/integration_test.yml
+++ b/.github/workflows/integration_test.yml
@@ -23,15 +23,19 @@ jobs:
         path: 'home/runner/travisci-tools'
         ref: 'master'
     - name: set SDK Branch if PR
+      env: 
+        HEAD_REF: ${{ github.head_ref }}
       if: ${{ github.event_name == 'pull_request' }}
       run: |
-        echo "SDK_BRANCH=${{ github.head_ref }}" >> $GITHUB_ENV
-        echo "TRAVIS_BRANCH=${{ github.head_ref }}" >> $GITHUB_ENV
+        echo "SDK_BRANCH=$HEAD_REF" >> $GITHUB_ENV
+        echo "TRAVIS_BRANCH=$HEAD_REF" >> $GITHUB_ENV
     - name: set SDK Branch if not pull request
+      env:
+        REF_NAME: ${{ github.ref_name }}
       if: ${{ github.event_name != 'pull_request' }}
       run: |
-        echo "SDK_BRANCH=${{ github.ref_name }}" >> $GITHUB_ENV
-        echo "TRAVIS_BRANCH=${{ github.ref_name }}" >> $GITHUB_ENV
+        echo "SDK_BRANCH=$REF_NAME" >> $GITHUB_ENV
+        echo "TRAVIS_BRANCH=$REF_NAME" >> $GITHUB_ENV
     - name: Trigger build
       env:
         SDK: csharp