Skip to content

Commit 00ce173

Browse files
francisffrancisf
authored
Merge pull request #7 from Archish27/master
Updated @actions/core security vulnerability fixes
2 parents c81751a + dfbfda1 commit 00ce173

File tree

8 files changed

+184
-54
lines changed

8 files changed

+184
-54
lines changed

‎setup-env/dist/index.js‎

Lines changed: 84 additions & 19 deletions
Original file line numberDiff line numberDiff line change
@@ -151,6 +151,32 @@ function onceStrict (fn) {
151151
}
152152

153153

154+
/***/ }),
155+
156+
/***/ 82:
157+
/***/ (function(__unusedmodule, exports) {
158+
159+
"use strict";
160+
161+
// We use any as a valid input type
162+
/* eslint-disable @typescript-eslint/no-explicit-any */
163+
Object.defineProperty(exports, "__esModule", { value: true });
164+
/**
165+
* Sanitizes an input into a string so it can be passed into issueCommand safely
166+
* @param input input to sanitize into a string
167+
*/
168+
function toCommandValue(input) {
169+
if (input === null || input === undefined) {
170+
return '';
171+
}
172+
else if (typeof input === 'string' || input instanceof String) {
173+
return input;
174+
}
175+
return JSON.stringify(input);
176+
}
177+
exports.toCommandValue = toCommandValue;
178+
//# sourceMappingURL=utils.js.map
179+
154180
/***/ }),
155181

156182
/***/ 87:
@@ -160,6 +186,42 @@ module.exports = require("os");
160186

161187
/***/ }),
162188

189+
/***/ 102:
190+
/***/ (function(__unusedmodule, exports, __webpack_require__) {
191+
192+
"use strict";
193+
194+
// For internal use, subject to change.
195+
var __importStar = (this && this.__importStar) || function (mod) {
196+
if (mod && mod.__esModule) return mod;
197+
var result = {};
198+
if (mod != null) for (var k in mod) if (Object.hasOwnProperty.call(mod, k)) result[k] = mod[k];
199+
result["default"] = mod;
200+
return result;
201+
};
202+
Object.defineProperty(exports, "__esModule", { value: true });
203+
// We use any as a valid input type
204+
/* eslint-disable @typescript-eslint/no-explicit-any */
205+
const fs = __importStar(__webpack_require__(747));
206+
const os = __importStar(__webpack_require__(87));
207+
const utils_1 = __webpack_require__(82);
208+
function issueCommand(command, message) {
209+
const filePath = process.env[`GITHUB_${command}`];
210+
if (!filePath) {
211+
throw new Error(`Unable to find environment variable for file command ${command}`);
212+
}
213+
if (!fs.existsSync(filePath)) {
214+
throw new Error(`Missing file at path: ${filePath}`);
215+
}
216+
fs.appendFileSync(filePath, `${utils_1.toCommandValue(message)}${os.EOL}`, {
217+
encoding: 'utf8'
218+
});
219+
}
220+
exports.issueCommand = issueCommand;
221+
//# sourceMappingURL=file-command.js.map
222+
223+
/***/ }),
224+
163225
/***/ 127:
164226
/***/ (function(__unusedmodule, exports, __webpack_require__) {
165227

@@ -1261,6 +1323,7 @@ var __importStar = (this && this.__importStar) || function (mod) {
12611323
};
12621324
Object.defineProperty(exports, "__esModule", { value: true });
12631325
const os = __importStar(__webpack_require__(87));
1326+
const utils_1 = __webpack_require__(82);
12641327
/**
12651328
* Commands
12661329
*
@@ -1314,28 +1377,14 @@ class Command {
13141377
return cmdStr;
13151378
}
13161379
}
1317-
/**
1318-
* Sanitizes an input into a string so it can be passed into issueCommand safely
1319-
* @param input input to sanitize into a string
1320-
*/
1321-
function toCommandValue(input) {
1322-
if (input === null || input === undefined) {
1323-
return '';
1324-
}
1325-
else if (typeof input === 'string' || input instanceof String) {
1326-
return input;
1327-
}
1328-
return JSON.stringify(input);
1329-
}
1330-
exports.toCommandValue = toCommandValue;
13311380
function escapeData(s) {
1332-
return toCommandValue(s)
1381+
return utils_1.toCommandValue(s)
13331382
.replace(/%/g, '%25')
13341383
.replace(/\r/g, '%0D')
13351384
.replace(/\n/g, '%0A');
13361385
}
13371386
function escapeProperty(s) {
1338-
return toCommandValue(s)
1387+
return utils_1.toCommandValue(s)
13391388
.replace(/%/g, '%25')
13401389
.replace(/\r/g, '%0D')
13411390
.replace(/\n/g, '%0A')
@@ -3309,6 +3358,8 @@ var __importStar = (this && this.__importStar) || function (mod) {
33093358
};
33103359
Object.defineProperty(exports, "__esModule", { value: true });
33113360
const command_1 = __webpack_require__(431);
3361+
const file_command_1 = __webpack_require__(102);
3362+
const utils_1 = __webpack_require__(82);
33123363
const os = __importStar(__webpack_require__(87));
33133364
const path = __importStar(__webpack_require__(622));
33143365
/**
@@ -3335,9 +3386,17 @@ var ExitCode;
33353386
*/
33363387
// eslint-disable-next-line @typescript-eslint/no-explicit-any
33373388
function exportVariable(name, val) {
3338-
const convertedVal = command_1.toCommandValue(val);
3389+
const convertedVal = utils_1.toCommandValue(val);
33393390
process.env[name] = convertedVal;
3340-
command_1.issueCommand('set-env', { name }, convertedVal);
3391+
const filePath = process.env['GITHUB_ENV'] || '';
3392+
if (filePath) {
3393+
const delimiter = '_GitHubActionsFileCommandDelimeter_';
3394+
const commandValue = `${name}<<${delimiter}${os.EOL}${convertedVal}${os.EOL}${delimiter}`;
3395+
file_command_1.issueCommand('ENV', commandValue);
3396+
}
3397+
else {
3398+
command_1.issueCommand('set-env', { name }, convertedVal);
3399+
}
33413400
}
33423401
exports.exportVariable = exportVariable;
33433402
/**
@@ -3353,7 +3412,13 @@ exports.setSecret = setSecret;
33533412
* @param inputPath
33543413
*/
33553414
function addPath(inputPath) {
3356-
command_1.issueCommand('add-path', {}, inputPath);
3415+
const filePath = process.env['GITHUB_PATH'] || '';
3416+
if (filePath) {
3417+
file_command_1.issueCommand('PATH', inputPath);
3418+
}
3419+
else {
3420+
command_1.issueCommand('add-path', {}, inputPath);
3421+
}
33573422
process.env['PATH'] = `${inputPath}${path.delimiter}${process.env['PATH']}`;
33583423
}
33593424
exports.addPath = addPath;

‎setup-env/package-lock.json‎

Lines changed: 4 additions & 4 deletions
Some generated files are not rendered by default. Learn more about customizing how changed files appear on GitHub.

‎setup-env/package.json‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,6 @@
11
{
22
"name": "setup-env",
3-
"version": "1.0.0",
3+
"version": "1.0.1",
44
"description": "Setup BrowserStack Test Environment",
55
"main": "src/index.js",
66
"scripts": {
@@ -25,7 +25,7 @@
2525
"author": "",
2626
"license": "MIT",
2727
"dependencies": {
28-
"@actions/core": "^1.2.4",
28+
"@actions/core": "^1.2.6",
2929
"@actions/github": "^4.0.0"
3030
},
3131
"devDependencies": {

‎setup-local/dist/index.js‎

Lines changed: 85 additions & 20 deletions
Original file line numberDiff line numberDiff line change
@@ -1275,7 +1275,7 @@ class BinaryControl {
12751275
if (!error) {
12761276
const outputParsed = JSON.parse(output);
12771277
if (outputParsed.state === LOCAL_BINARY_TRIGGER.START.CONNECTED) {
1278-
core.info(`Local tunnel status: ${outputParsed.message}`);
1278+
core.info(`Local tunnel status: ${JSON.stringify(outputParsed.message)}`);
12791279
return;
12801280
}
12811281

@@ -1616,6 +1616,32 @@ exports.default = _default;
16161616

16171617
/***/ }),
16181618

1619+
/***/ 82:
1620+
/***/ (function(__unusedmodule, exports) {
1621+
1622+
"use strict";
1623+
1624+
// We use any as a valid input type
1625+
/* eslint-disable @typescript-eslint/no-explicit-any */
1626+
Object.defineProperty(exports, "__esModule", { value: true });
1627+
/**
1628+
* Sanitizes an input into a string so it can be passed into issueCommand safely
1629+
* @param input input to sanitize into a string
1630+
*/
1631+
function toCommandValue(input) {
1632+
if (input === null || input === undefined) {
1633+
return '';
1634+
}
1635+
else if (typeof input === 'string' || input instanceof String) {
1636+
return input;
1637+
}
1638+
return JSON.stringify(input);
1639+
}
1640+
exports.toCommandValue = toCommandValue;
1641+
//# sourceMappingURL=utils.js.map
1642+
1643+
/***/ }),
1644+
16191645
/***/ 87:
16201646
/***/ (function(module) {
16211647

@@ -2551,6 +2577,42 @@ function regExpEscape (s) {
25512577
}
25522578

25532579

2580+
/***/ }),
2581+
2582+
/***/ 102:
2583+
/***/ (function(__unusedmodule, exports, __webpack_require__) {
2584+
2585+
"use strict";
2586+
2587+
// For internal use, subject to change.
2588+
var __importStar = (this && this.__importStar) || function (mod) {
2589+
if (mod && mod.__esModule) return mod;
2590+
var result = {};
2591+
if (mod != null) for (var k in mod) if (Object.hasOwnProperty.call(mod, k)) result[k] = mod[k];
2592+
result["default"] = mod;
2593+
return result;
2594+
};
2595+
Object.defineProperty(exports, "__esModule", { value: true });
2596+
// We use any as a valid input type
2597+
/* eslint-disable @typescript-eslint/no-explicit-any */
2598+
const fs = __importStar(__webpack_require__(747));
2599+
const os = __importStar(__webpack_require__(87));
2600+
const utils_1 = __webpack_require__(82);
2601+
function issueCommand(command, message) {
2602+
const filePath = process.env[`GITHUB_${command}`];
2603+
if (!filePath) {
2604+
throw new Error(`Unable to find environment variable for file command ${command}`);
2605+
}
2606+
if (!fs.existsSync(filePath)) {
2607+
throw new Error(`Missing file at path: ${filePath}`);
2608+
}
2609+
fs.appendFileSync(filePath, `${utils_1.toCommandValue(message)}${os.EOL}`, {
2610+
encoding: 'utf8'
2611+
});
2612+
}
2613+
exports.issueCommand = issueCommand;
2614+
//# sourceMappingURL=file-command.js.map
2615+
25542616
/***/ }),
25552617

25562618
/***/ 109:
@@ -8840,6 +8902,7 @@ var __importStar = (this && this.__importStar) || function (mod) {
88408902
};
88418903
Object.defineProperty(exports, "__esModule", { value: true });
88428904
const os = __importStar(__webpack_require__(87));
8905+
const utils_1 = __webpack_require__(82);
88438906
/**
88448907
* Commands
88458908
*
@@ -8893,28 +8956,14 @@ class Command {
88938956
return cmdStr;
88948957
}
88958958
}
8896-
/**
8897-
* Sanitizes an input into a string so it can be passed into issueCommand safely
8898-
* @param input input to sanitize into a string
8899-
*/
8900-
function toCommandValue(input) {
8901-
if (input === null || input === undefined) {
8902-
return '';
8903-
}
8904-
else if (typeof input === 'string' || input instanceof String) {
8905-
return input;
8906-
}
8907-
return JSON.stringify(input);
8908-
}
8909-
exports.toCommandValue = toCommandValue;
89108959
function escapeData(s) {
8911-
return toCommandValue(s)
8960+
return utils_1.toCommandValue(s)
89128961
.replace(/%/g, '%25')
89138962
.replace(/\r/g, '%0D')
89148963
.replace(/\n/g, '%0A');
89158964
}
89168965
function escapeProperty(s) {
8917-
return toCommandValue(s)
8966+
return utils_1.toCommandValue(s)
89188967
.replace(/%/g, '%25')
89198968
.replace(/\r/g, '%0D')
89208969
.replace(/\n/g, '%0A')
@@ -10941,6 +10990,8 @@ var __importStar = (this && this.__importStar) || function (mod) {
1094110990
};
1094210991
Object.defineProperty(exports, "__esModule", { value: true });
1094310992
const command_1 = __webpack_require__(431);
10993+
const file_command_1 = __webpack_require__(102);
10994+
const utils_1 = __webpack_require__(82);
1094410995
const os = __importStar(__webpack_require__(87));
1094510996
const path = __importStar(__webpack_require__(622));
1094610997
/**
@@ -10967,9 +11018,17 @@ var ExitCode;
1096711018
*/
1096811019
// eslint-disable-next-line @typescript-eslint/no-explicit-any
1096911020
function exportVariable(name, val) {
10970-
const convertedVal = command_1.toCommandValue(val);
11021+
const convertedVal = utils_1.toCommandValue(val);
1097111022
process.env[name] = convertedVal;
10972-
command_1.issueCommand('set-env', { name }, convertedVal);
11023+
const filePath = process.env['GITHUB_ENV'] || '';
11024+
if (filePath) {
11025+
const delimiter = '_GitHubActionsFileCommandDelimeter_';
11026+
const commandValue = `${name}<<${delimiter}${os.EOL}${convertedVal}${os.EOL}${delimiter}`;
11027+
file_command_1.issueCommand('ENV', commandValue);
11028+
}
11029+
else {
11030+
command_1.issueCommand('set-env', { name }, convertedVal);
11031+
}
1097311032
}
1097411033
exports.exportVariable = exportVariable;
1097511034
/**
@@ -10985,7 +11044,13 @@ exports.setSecret = setSecret;
1098511044
* @param inputPath
1098611045
*/
1098711046
function addPath(inputPath) {
10988-
command_1.issueCommand('add-path', {}, inputPath);
11047+
const filePath = process.env['GITHUB_PATH'] || '';
11048+
if (filePath) {
11049+
file_command_1.issueCommand('PATH', inputPath);
11050+
}
11051+
else {
11052+
command_1.issueCommand('add-path', {}, inputPath);
11053+
}
1098911054
process.env['PATH'] = `${inputPath}${path.delimiter}${process.env['PATH']}`;
1099011055
}
1099111056
exports.addPath = addPath;

‎setup-local/package-lock.json‎

Lines changed: 4 additions & 4 deletions
Some generated files are not rendered by default. Learn more about customizing how changed files appear on GitHub.

‎setup-local/package.json‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,6 @@
11
{
22
"name": "setup-local",
3-
"version": "1.0.0",
3+
"version": "1.0.1",
44
"description": "Setup BrowserStack Local Binary",
55
"main": "src/index.js",
66
"scripts": {
@@ -27,7 +27,7 @@
2727
"license": "MIT",
2828
"dependencies": {
2929
"@actions/artifact": "^0.3.5",
30-
"@actions/core": "^1.2.4",
30+
"@actions/core": "^1.2.6",
3131
"@actions/exec": "^1.0.4",
3232
"@actions/github": "^4.0.0",
3333
"@actions/io": "^1.0.2",

0 commit comments

Comments
 (0)