Update documentation example usage to avoid executing untrusted inputs#336
Update documentation example usage to avoid executing untrusted inputs#336Codex- merged 1 commit intoCodex-:mainfrom
Conversation
The example shown in the documentation: https://github.com/Codex-/return-dispatch/blob/16fa9d14771c4d56ae0196bbda1d3c17f7f3650f/README.md?plain=1#L67-L68 Is vulnerable to untrusted input execution (i.e. `distinct_id` _could_ be a malicious command). See [this document](https://securitylab.github.com/resources/github-actions-untrusted-input/) (specifically - `Remediation`) for more details. Also, the command can be simplified [as `inputs.blah` is equivalent to `github.event.inputs.blah`](https://docs.github.com/en/actions/reference/workflows-and-actions/events-that-trigger-workflows#providing-inputs), but [_also_ handles `workflow_call` `inputs`](https://github.blog/changelog/2022-06-09-github-actions-inputs-unified-across-manual-and-reusable-workflows/).
|
No actionable comments were generated in the recent review. 🎉 ℹ️ Recent review info⚙️ Run configurationConfiguration used: defaults Review profile: CHILL Plan: Pro Run ID: 📒 Files selected for processing (1)
📝 WalkthroughWalkthroughThe README.md file updates a GitHub Actions workflow example showing how to receive repository inputs. The step that prints Changes
Estimated code review effort🎯 1 (Trivial) | ⏱️ ~3 minutes Poem
🚥 Pre-merge checks | ✅ 3✅ Passed checks (3 passed)
✏️ Tip: You can configure your own custom pre-merge checks in the settings. ✨ Finishing Touches🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment Tip CodeRabbit can suggest fixes for GitHub Check annotations.Configure the |
2 participants
The example shown in the documentation:
return-dispatch/README.md
Lines 67 to 68 in 16fa9d1
Is vulnerable to untrusted input execution (i.e.
distinct_idcould be a malicious command). See this document (specifically -Remediation) for more details.Also, the command can be simplified as
inputs.blahis equivalent togithub.event.inputs.blah, but also handlesworkflow_callinputs.Summary by CodeRabbit