Skip to content

Conversation

@amitsingh05667
Copy link
Member

Fix Script Injection Vulnerability in RL Scanner

Summary

This PR fixes a potential script injection vulnerability by avoiding direct shell interpolation of user inputs. Instead, user-provided values are safely passed through environment variables.

Changes

  • Added ARTIFACT_PATH and VERSION to the env: block
  • Updated the shell script to use $ARTIFACT_PATH and $VERSION instead of ${{ inputs.* }}

@amitsingh05667 amitsingh05667 requested a review from a team as a code owner January 6, 2026 07:48
@codecov
Copy link

codecov bot commented Jan 6, 2026

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 88.90%. Comparing base (1e93ed5) to head (f9d2b1f).

Additional details and impacted files

Impacted file tree graph

@@           Coverage Diff           @@
##           master    #1287   +/-   ##
=======================================
  Coverage   88.90%   88.90%           
=======================================
  Files         371      371           
  Lines       16966    16966           
  Branches     8413     8413           
=======================================
  Hits        15084    15084           
  Misses       1882     1882           
Flag Coverage Δ
alltests 88.90% <ø> (ø)

Flags with carried forward coverage won't be shown. Click here to find out more.

🚀 New features to boost your workflow:
  • ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
  • 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants