Skip to content

Commit 318220e

Browse files
author
Oleg
committed
Defend against template injection
1 parent 7480761 commit 318220e

File tree

2 files changed

+41
-15
lines changed

2 files changed

+41
-15
lines changed

‎.github/workflows/build-all.yml

Lines changed: 17 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -45,7 +45,9 @@ jobs:
4545

4646
- name: Compute implementation name
4747
id: impl
48-
run: echo "name=$(echo '${{ github.repository }}' | awk -F '/' '{print $2}')" >> $GITHUB_OUTPUT
48+
env:
49+
GH_REPOSITORY: ${{ github.repository }}
50+
run: echo "name=$(echo '${GH_REPOSITORY}' | awk -F '/' '{print $2}')" >> $GITHUB_OUTPUT
4951

5052
- name: Install bowtie
5153
uses: bowtie-json-schema/bowtie@main
@@ -69,20 +71,26 @@ jobs:
6971
echo "DOCKER_HOST=unix://$(podman info --format '{{.Host.RemoteSocket.Path}}')" >> $GITHUB_ENV
7072
7173
- name: Smoke Test
74+
env:
75+
IMAGE_WITH_TAG: ${{ steps.build_image.outputs.image-with-tag }}
7276
run: |
73-
bowtie smoke -i "localhost/${{ steps.build_image.outputs.image-with-tag }}" --format json
74-
bowtie smoke -i "localhost/${{ steps.build_image.outputs.image-with-tag }}" --format markdown >> $GITHUB_STEP_SUMMARY
77+
bowtie smoke -i "localhost/${IMAGE_WITH_TAG}" --format json
78+
bowtie smoke -i "localhost/${IMAGE_WITH_TAG}" --format markdown >> $GITHUB_STEP_SUMMARY
7579
7680
- name: Collect current version
7781
id: current-version
82+
env:
83+
IMAGE_WITH_TAG: ${{ steps.build_image.outputs.image-with-tag }}
7884
run: |
7985
version=$(bowtie info \
80-
--implementation "localhost/${{ steps.build_image.outputs.image-with-tag }}" \
86+
--implementation "localhost/${IMAGE_WITH_TAG}" \
8187
--format json | jq -r '.version // empty')
8288
echo "value=${version}" >> $GITHUB_OUTPUT
8389
8490
- name: Print collected version
85-
run: echo "current_version=${{ steps.current-version.outputs.value }}"
91+
env:
92+
CURRENT_VERSION: ${{ steps.current-version.outputs.value }}
93+
run: echo "current_version=${CURRENT_VERSION}"
8694

8795
- name: Log in to ghcr.io
8896
uses: redhat-actions/podman-login@v1
@@ -92,7 +100,10 @@ jobs:
92100
registry: ${{ env.IMAGE_REGISTRY }}
93101

94102
- name: Add tag with version to the image
95-
run: podman tag ${{ steps.build_image.outputs.image-with-tag }} ${{ steps.build_image.outputs.image }}:${{ steps.current-version.outputs.value }}
103+
env:
104+
IMAGE_WITH_TAG: ${{ steps.build_image.outputs.image-with-tag }}
105+
IMAGE_WITH_VERSION: "${{ steps.build_image.outputs.image }}:${{ steps.current-version.outputs.value }}"
106+
run: podman tag ${IMAGE_WITH_TAG} ${IMAGE_WITH_VERSION}
96107

97108
- name: Publish
98109
id: push

‎.github/workflows/build.yml

Lines changed: 24 additions & 9 deletions
Original file line numberDiff line numberDiff line change
@@ -32,13 +32,17 @@ jobs:
3232

3333
- name: Compute implementation name
3434
id: impl
35-
run: echo "name=$(echo '${{ github.repository }}' | awk -F '/' '{print $2}')" >> $GITHUB_OUTPUT
35+
env:
36+
GH_REPOSITORY: ${{ github.repository }}
37+
run: echo "name=$(echo '${GH_REPOSITORY}' | awk -F '/' '{print $2}')" >> $GITHUB_OUTPUT
3638

3739
- name: Compute latest implementation version
3840
id: version
41+
env:
42+
IMPL_NAME: ${{ steps.impl.outputs.name }}
3943
run: |
4044
version=$(bowtie info \
41-
--implementation ${{ steps.impl.outputs.name }} \
45+
--implementation ${IMPL_NAME} \
4246
--format json | jq -r '.version // empty')
4347
echo "value=${version}" >> $GITHUB_OUTPUT
4448
@@ -88,20 +92,27 @@ jobs:
8892
enable-cache: true
8993

9094
- name: Smoke Test
95+
env:
96+
IMAGE_WITH_TAG: ${{ steps.build_image.outputs.image-with-tag }}
9197
run: |
92-
bowtie smoke -i "localhost/${{ steps.build_image.outputs.image-with-tag }}" --format json
93-
bowtie smoke -i "localhost/${{ steps.build_image.outputs.image-with-tag }}" --format markdown >> $GITHUB_STEP_SUMMARY
98+
bowtie smoke -i "localhost/${IMAGE_WITH_TAG}" --format json
99+
bowtie smoke -i "localhost/${IMAGE_WITH_TAG}" --format markdown >> $GITHUB_STEP_SUMMARY
94100
95101
- name: Collect current version
96102
id: current-version
103+
env:
104+
IMAGE_WITH_TAG: ${{ steps.build_image.outputs.image-with-tag }}
97105
run: |
98106
version=$(bowtie info \
99-
--implementation "localhost/${{ steps.build_image.outputs.image-with-tag }}" \
107+
--implementation "localhost/${IMAGE_WITH_TAG}" \
100108
--format json | jq -r '.version // empty')
101109
echo "value=${version}" >> $GITHUB_OUTPUT
102110
103111
- name: Print collected versions
104-
run: echo "latest_version=${{ needs.meta.outputs.latest-version }}; current_version=${{ steps.current-version.outputs.value }}"
112+
env:
113+
LATEST_VERSION: ${{ needs.meta.outputs.latest-version }}
114+
CURRENT_VERSION: ${{ steps.current-version.outputs.value }}
115+
run: echo "latest_version=${LATEST_VERSION}; current_version=${CURRENT_VERSION}"
105116

106117
- name: Log in to ghcr.io
107118
uses: redhat-actions/podman-login@v1
@@ -112,7 +123,10 @@ jobs:
112123
if: github.event_name == 'push' && github.ref == 'refs/heads/main'
113124

114125
- name: Add tag with version to the image
115-
run: podman tag ${{ steps.build_image.outputs.image-with-tag }} ${{ steps.build_image.outputs.image }}:${{ steps.current-version.outputs.value }}
126+
env:
127+
IMAGE_WITH_TAG: ${{ steps.build_image.outputs.image-with-tag }}
128+
IMAGE_WITH_VERSION: "${{ steps.build_image.outputs.image }}:${{ steps.current-version.outputs.value }}"
129+
run: podman tag ${IMAGE_WITH_TAG} ${IMAGE_WITH_VERSION}
116130
if: github.event_name == 'push' && github.ref == 'refs/heads/main'
117131

118132
- name: Publish
@@ -144,6 +158,7 @@ jobs:
144158
env:
145159
TAG: v${{ needs.meta.outputs.latest-version }}
146160
COMMIT: ${{ github.event.before }}
161+
GH_REPOSITORY: ${{ github.repository }}
147162

148163
steps:
149164

@@ -156,7 +171,7 @@ jobs:
156171
--method POST
157172
-H "Accept: application/vnd.github+json"
158173
-H "X-GitHub-Api-Version: 2022-11-28"
159-
/repos/${{ github.repository }}/git/refs
174+
/repos/${GH_REPOSITORY}/git/refs
160175
-f "ref=refs/tags/$TAG"
161176
-f "sha=$COMMIT"
162177
@@ -168,7 +183,7 @@ jobs:
168183
--method POST
169184
-H "Accept: application/vnd.github+json"
170185
-H "X-GitHub-Api-Version: 2022-11-28"
171-
/repos/${{ github.repository }}/releases
186+
/repos/${GH_REPOSITORY}/releases
172187
-f "tag_name=$TAG"
173188
-f "name=$TAG"
174189
-f "body=Automatic release for $TAG"

0 commit comments

Comments
 (0)