Skip to content

v0.1.10

Choose a tag to compare

View all tags
@reuvenharrison reuvenharrison released this 27 Jul 11:03
· 6 commits to main since this release
v0.1.10
0ab8ad2
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.

Security release. Every action now runs on oasdiff v1.26.1.

Highlights

Security fix: git revision parsed as a git option (GHSA-m3wq-w7x2-4q6m)

All six actions (breaking, changelog, diff, pr-comment, validate, verify) move their base image from tufin/oasdiff:v1.26.0 to tufin/oasdiff:v1.26.1, which fixes an option-injection issue on the git-revision load path.

oasdiff passed git revisions to git as operands with no end-of-options separator, so a revision beginning with - was parsed by git as an option rather than a revision. git show --output=<path> writes git's output to a chosen path (an arbitrary file overwrite running as the invoking user), and git fetch --upload-pack=<program> makes git execute a program.

oasdiff v1.26.1 fixes this in two layers: every git invocation now passes --end-of-options, and a revision beginning with - is rejected before git is invoked.

Who should upgrade: anyone pinned to an exact action version. If you pin @v0, you already have this, since v0 now points at this release.

Workflow authors: if you interpolate untrusted input into the base: or revision: inputs, upgrade. Workflows that pass literal refs or file paths were not affected.

Full Changelog: v0.1.9...v0.1.10

Assets 2
Loading