chore: Harden workflow against command injection in PR title validation#18771
Merged
Conversation
hudi-agent
reviewed
May 18, 2026
Contributor
hudi-agent
left a comment
hudi-agent
left a comment
There was a problem hiding this comment.
🤖 This review was generated by an AI agent and may contain mistakes. Please verify any suggestions before applying.
No reviewable code files in this PR.
cc @yihua
yihua
changed the title
github-actions
Bot
added
size:XS
Codecov Report✅ All modified and coverable lines are covered by tests. Additional details and impacted files@@ Coverage Diff @@
## master #18771 +/- ##
=========================================
Coverage 68.16% 68.16%
- Complexity 29156 29157 +1
=========================================
Files 2521 2521
Lines 141371 141371
Branches 17549 17549
=========================================
+ Hits 96359 96368 +9
+ Misses 37081 37071 -10
- Partials 7931 7932 +1
Flags with carried forward coverage won't be shown. Click here to find out more. 🚀 New features to boost your workflow:
|
yihua
added a commit
that referenced
this pull request
May 20, 2026
…on (#18771) Co-authored-by: Y Ethan Guo <ethan.guoyihua@gmail.com>
dwshmilyss
pushed a commit
to dwshmilyss/hudi
that referenced
this pull request
May 21, 2026
…on (apache#18771) Co-authored-by: Y Ethan Guo <ethan.guoyihua@gmail.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
5 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Describe the issue this Pull Request addresses
Hi Apache Hudi Team,
As requested and suggested by Piotr P. Karwasz from the Apache Security Team, I am submitting this pull request to apply a security hardening improvement to the
pr_title_validation.ymlworkflow.Summary and Changelog
github.event.pull_request.titlecontext variable into an environment variable (env: PR_TITLE).$PR_TITLEinstead of direct inline expansion.This protects the project's CI/CD runner environment from potential arbitrary command execution (Command Injection) through crafted PR titles if trigger types or job permissions are ever modified in the future.
Best regards,
Rasul Rasulzada
Impact
Security fix
Contributor's checklist