SECURITY ISSUE: using * in message causes listing of circleci project root directory into notification

[williamfalconeruk]

Orb version:4.4.0

What happened:

Added a commit message with a simple * into a dynamic template section e.g.

{
    "blocks": [],
    "attachments":
    [
        {
            "color": "#508c18",
            "blocks":
            [
                {
                    "type": "header",
                    "text": {
                    "type": "plain_text",
                    "text": "Online LPA Development Environment Ready",
                    "emoji": false
                    }
                },
                {
                    "type": "section",
                    "text": {
                    "type": "mrkdwn",
                    "text": "public facing url: <https://${PUBLIC_FACING_DOMAIN}/home>"
                    }
                },
                {
                    "type": "section",
                    "text": {
                    "type": "mrkdwn",
                    "text": "front url: <https://${FRONT_DOMAIN}>"
                    }
                },
                {
                    "type": "section",
                    "text": {
                    "type": "mrkdwn",
                    "text": "admin url: <https://${ADMIN_DOMAIN}>"
                    }
                },
                {
                    "type": "context",
                    "elements":
                    [
                        {
                            "type": "mrkdwn",
                            "text": "commit. message: ${COMMIT_MESSAGE}"
                        }
                    ]
                }
            ]
        }
    ]
}

generates:

{
    "blocks": [],
    "attachments":
    [
        {
            "color": "#508c18",
            "blocks":
            [
                {
                    "type": "header",
                    "text": {
                    "type": "plain_text",
                    "text": "Online LPA Development Environment Ready",
                    "emoji": false
                    }
                },
                {
                    "type": "section",
                    "text": {
                    "type": "mrkdwn",
                    "text": "public facing url: <https://${PUBLIC_FACING_DOMAIN}/home>"
                    }
                },
                {
                    "type": "section",
                    "text": {
                    "type": "mrkdwn",
                    "text": "front url: <https://${FRONT_DOMAIN}>"
                    }
                },
                {
                    "type": "section",
                    "text": {
                    "type": "mrkdwn",
                    "text": "admin url: <https://${ADMIN_DOMAIN}>"
                    }
                },
                {
                    "type": "context",
                    "elements":
                    [
                        {
                            "type": "mrkdwn",
                            "text": "commit message: *"
                        }
                    ]
                }
            ]
        }
    ]
}

• Run orb
• The commit message lists the contents of the root of the ~/project directory in the message. details not provided for security reasons.

see : https://app.circleci.com/pipelines/github/ministryofjustice/opg-lpa/3727/workflows/58a73bf3-1282-4bce-9e99-52d9871efe30

Expected behavior:

it should show * as the notification content, not the directory contents.

Additional Information:

[klsetzer]

Is it possible to write Orbs in a different language? Writing secure code in shell is a mess.

[williamfalconeruk]

Is it possible to write Orbs in a different language? Writing secure code in shell is a mess.

I'm not exactly sure of this, we were having the same conversation internally just now about it. It would certainly be helpful. I guess you could write the orb to call some compiled go code or python for example, but not sure.

[EricRibeiro]

I couldn't replicate this in the latest version of the orb. I tried using the template provided above with * as the commit message. I'm populating COMMIT_MESSAGE in the following way:

echo 'export COMMIT_MESSAGE="$(git log --format=oneline -n 1 "$CIRCLE_SHA1")"' >> "$BASH_ENV"

I'll close the issue, but I'm happy to re-open it if the problem persists.