Action Required
This release fixes a command injection issue via the git_commit_message parameter.
The passed value was previously being interpolated into a shell string and run through eval, so shell metacharacters in it were executed rather than passed as text. Arbitrary commands could run on the runner, which holds PANTHEON_MACHINE_TOKEN and PANTHEON_SSH_KEY.
Affected versions are 0.9.0 - 0.9.3 when a workflow passes attacker-influenceable text in a PR title, branch name or body into git_commit_message, on a site with an existing live environment and not using skip_build_tools: true. The default generated message contains no caller-controlled text, so default configurations are not affected.
< 0.9.0 versions are also unaffected as they pass the message as a single quoted argument.
It is recommended to upgrade to 0.9.4 as soon as possible or avoid passing untrusted text into git_commit_message if you cannot update immediately.
Reported by @ndewhurst. (#175)
What's Changed
- ci: sign release version-bump commits via GitHub API by @jazzsequence in #165
- docs: document manual signing step for release PRs by @jazzsequence in #167
- docs: fix repository typo in README by @jazzsequence in #171
- fix: stop BATS leaking a multidev environment on every run by @jazzsequence in #177
- fix: support multiline git_commit_message, drop eval from deploy by @jazzsequence in #175
- fix: sweep closed-PR multidevs Build Tools misses by @jazzsequence in #174
- fix: report the multidev limit when target_env is set explicitly by @jazzsequence in #176
- feat: allow a per-site GitHub deployment environment by @jazzsequence in #182
- feat: add an opt-in branch-name strategy for Multidev names by @jazzsequence in #183
- [auto-doc] Update README.md by @jazzsequence in #180
- Release 0.9.4 by @jazzsequence in #185
Full Changelog: 0.9.3...0.9.4
