chore(deps): update tj-actions/changed-files action to v36 [security] - autoclosed #189
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
This PR contains the following updates:
v35
->v36
GitHub Vulnerability Alerts
CVE-2023-51664
Summary
The
tj-actions/changed-files
workflow allows for command injection in changed filenames, allowing an attacker to execute arbitrary code and potentially leak secrets.Details
The
changed-files
action returns a list of files changed in a commit or pull request which provides anescape_json
input enabled by default, only escapes"
for JSON values.This could potentially allow filenames that contain special characters such as
;
and ` (backtick) which can be used by an attacker to take over the GitHub Runner if the output value is used in a raw fashion (thus being directly replaced before execution) inside arun
block. By running custom commands an attacker may be able to steal secrets such asGITHUB_TOKEN
if triggered on other events thanpull_request
. For example onpush
.Proof of Concept
$(whoami).txt
which is a valid filename.List all changed files
step below.Example output:
Impact
This issue may lead to arbitrary command execution in the GitHub Runner.
Resolution
A new
safe_output
input would be enabled by default and return filename paths escaping special characters like ;, ` (backtick), $, (), etc for bash environments.A safe recommendation of using environment variables to store unsafe outputs.
Resources
Release Notes
tj-actions/changed-files (tj-actions/changed-files)
v36
Compare Source
Changes in v36.4.1
What's Changed
Full Changelog: tj-actions/changed-files@v36...v36.4.1
Changes in v36.4.0
What's Changed
Full Changelog: tj-actions/changed-files@v36...v36.4.0
Changes in v36.3.0
🚀 New Features
files_yaml
,files_yaml_from_source_file
this enables creating filters using YAML.Example
What's Changed
Full Changelog: tj-actions/changed-files@v36...v36.3.0
Changes in v36.2.1
What's Changed
Full Changelog: tj-actions/changed-files@v36...v36.2.1
Changes in v36.2.0
What's Changed
Full Changelog: tj-actions/changed-files@v36...v36.2.0
Changes in v36.1.0
What's Changed
Full Changelog: tj-actions/changed-files@v36...v36.1.0
Changes in v36.0.18
What's Changed
Full Changelog: tj-actions/changed-files@v36...v36.0.18
Changes in v36.0.17
What's Changed
Full Changelog: tj-actions/changed-files@v36...v36.0.17
Changes in v36.0.16
What's Changed
Full Changelog: tj-actions/changed-files@v36...v36.0.16
Changes in v36.0.15
What's Changed
Full Changelog: tj-actions/changed-files@v36...v36.0.15
Changes in v36.0.14
What's Changed
Full Changelog: tj-actions/changed-files@v36...v36.0.14
Changes in v36.0.13
What's Changed
Full Changelog: tj-actions/changed-files@v36...v36.0.13
Changes in v36.0.12
What's Changed
Full Changelog: tj-actions/changed-files@v36...v36.0.12
Changes in v36.0.11
What's Changed
Full Changelog: tj-actions/changed-files@v36...v36.0.11
Changes in v36.0.10
What's Changed
Full Changelog: tj-actions/changed-files@v36...v36.0.10
Changes in v36.0.9
What's Changed
Full Changelog: tj-actions/changed-files@v36...v36.0.9
Changes in v36.0.8
What's Changed
Full Changelog: tj-actions/changed-files@v36...v36.0.8
Changes in v36.0.7
What's Changed
Full Changelog: tj-actions/changed-files@v36...v36.0.7
Changes in v36.0.6
What's Changed
Full Changelog: tj-actions/changed-files@v36...v36.0.6
Changes in v36.0.5
What's Changed
Full Changelog: tj-actions/changed-files@v36...v36.0.5
Changes in v36.0.4
What's Changed
Full Changelog: tj-actions/changed-files@v36...v36.0.4
Changes in v36.0.3
What's Changed
Full Changelog: tj-actions/changed-files@v36...v36.0.3
Changes in v36.0.2
What's Changed
Full Changelog: tj-actions/changed-files@v36...v36.0.2
Changes in v36.0.1
What's Changed
Full Changelog: tj-actions/changed-files@v36...v36.0.1
Changes in v36.0.0
🚀 Announcing v36: Major Performance Improvements and Enhanced Functionality!
We're thrilled to announce the release of v36! This new version brings a lot of exciting improvements and sets the stage for even more progress in the future.
We've made a major upgrade from a composite action to a javascript action, which brings a number of benefits, including:
**.js
would match all .js filesAnd that's just the beginning! We've also made some important changes to our inputs and outputs:
🔥🔥 BREAKING CHANGES 🔥 🔥
Inputs
json_raw_format
: We've changed this input toescape_json
, which returns unescaped values when set tofalse
.match_directories
: We've removed this input, but you can still get matching directories by settingdir_names
totrue
.diff_relative
: This input now has a default value oftrue
.files_from_source_file_separator
: We've added this input to enable using a custom separator to split filenames passed via thefiles_from_source_file
input.files_ignore_from_source_file_separator
: We've also added this input with a similar use case for thefiles_ignore_from_source_file
input.Outputs
any_(changed|modified|deleted)
: This output now always returns either atrue
orfalse
as opposed to an empty string when there are no patterns.only_(changed|modified|deleted)
: Similar changes also apply here, which now return either atrue
orfalse
.Versioning
[...]-sec
tags will no longer be created going forward, with the introduction of this new design.We're excited about all of these changes and can't wait for you to try them out. As always, if you have any questions or feedback, please don't hesitate to reach out!
Full Changelog: tj-actions/changed-files@v35...v36.0.0
Configuration
📅 Schedule: Branch creation - "" (UTC), Automerge - At any time (no schedule defined).
🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.
♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.
🔕 Ignore: Close this PR and you won't be reminded about this update again.
This PR was generated by Mend Renovate. View the repository job log.