Skip to content

Commit 0f3281c

Browse files
author
Alvaro Muñoz
committed
Support bash heredoc
1 parent 00f6ff8 commit 0f3281c

File tree

9 files changed

+92
-32
lines changed

9 files changed

+92
-32
lines changed

‎ql/lib/codeql/actions/Ast.qll

Lines changed: 36 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -46,18 +46,39 @@ module Utils {
4646

4747
bindingset[var]
4848
private string multilineAssignmentRegex(string var) {
49+
// eg:
50+
// echo "PR_TITLE<<EOF" >> $GITHUB_ENV
51+
// echo "$TITLE" >> $GITHUB_ENV
52+
// echo "EOF" >> $GITHUB_ENV
4953
result =
50-
".*(echo|Write-Output)\\s+(.*)<<\\s*([A-Z]*)EOF(.+)(echo|Write-Output)\\s+(\"|')?([A-Z]*)EOF(\"|')?\\s*>>\\s*(\"|')?\\$(\\{)?GITHUB_"
54+
".*(echo|Write-Output)\\s+(.*)<<[\\-]*\\s*([A-Z]*)EOF(.+)(echo|Write-Output)\\s+(\"|')?([A-Z]*)EOF(\"|')?\\s*>>\\s*(\"|')?\\$(\\{)?GITHUB_"
5155
+ var.toUpperCase() + "(\\})?(\"|')?.*"
5256
}
5357

5458
bindingset[var]
5559
private string multilineBlockAssignmentRegex(string var) {
60+
// eg:
61+
// {
62+
// echo 'JSON_RESPONSE<<EOF'
63+
// echo "$TITLE" >> "$GITHUB_ENV"
64+
// echo EOF
65+
// } >> "$GITHUB_ENV"
5666
result =
57-
".*\\{(\\s|::NEW_LINE::)*(echo|Write-Output)\\s+(.*)<<\\s*([A-Z]*)EOF(.+)(echo|Write-Output)\\s+(\"|')?([A-Z]*)EOF(\"|')?(\\s|::NEW_LINE::)*\\}\\s*>>\\s*(\"|')?\\$(\\{)?GITHUB_"
67+
".*\\{(\\s|::NEW_LINE::)*(echo|Write-Output)\\s+(.*)<<[\\-]*\\s*([A-Z]*)EOF(.+)(echo|Write-Output)\\s+(\"|')?([A-Z]*)EOF(\"|')?(\\s|::NEW_LINE::)*\\}\\s*>>\\s*(\"|')?\\$(\\{)?GITHUB_"
5868
+ var.toUpperCase() + "(\\})?(\"|')?.*"
5969
}
6070

71+
bindingset[var]
72+
private string multilineHereDocAssignmentRegex(string var) {
73+
// eg:
74+
// cat <<-EOF >> "$GITHUB_ENV"
75+
// echo "FOO=$TITLE"
76+
// EOF
77+
result =
78+
".*cat\\s*<<[\\-]*\\s*[A-Z]*EOF\\s*>>\\s*[\"']*\\$[\\{]*GITHUB_.*" + var.toUpperCase() +
79+
"[\\}]*[\"']*.*(echo|Write-Output)\\s+([^=]+)=(.*)::NEW_LINE::.*EOF.*"
80+
}
81+
6182
bindingset[script, var]
6283
predicate extractMultilineAssignment(string script, string var, string key, string value) {
6384
// multiline assignment
@@ -87,6 +108,19 @@ module Utils {
87108
.splitAt("\n") + ")" and
88109
key = trimQuotes(flattenedScript.regexpCapture(multilineBlockAssignmentRegex(var), 3))
89110
)
111+
or
112+
// multiline heredoc assignment
113+
exists(string flattenedScript |
114+
flattenedScript = script.replaceAll("\n", "::NEW_LINE::") and
115+
value =
116+
trimQuotes(flattenedScript.regexpCapture(multilineHereDocAssignmentRegex(var), 3))
117+
.regexpReplaceAll("\\s*>>\\s*(\"|')?\\$(\\{)?GITHUB_" + var.toUpperCase() +
118+
"(\\})?(\"|')?", "")
119+
.replaceAll("::NEW_LINE::", "\n")
120+
.trim()
121+
.splitAt("\n") and
122+
key = trimQuotes(flattenedScript.regexpCapture(multilineHereDocAssignmentRegex(var), 2))
123+
)
90124
}
91125

92126
bindingset[line]

‎ql/lib/codeql/actions/security/EnvVarInjectionQuery.qll

Lines changed: 4 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -39,7 +39,10 @@ class EnvVarInjectionFromMaDSink extends EnvVarInjectionSink {
3939
* that is used to construct and evaluate an environment variable.
4040
*/
4141
private module EnvVarInjectionConfig implements DataFlow::ConfigSig {
42-
predicate isSource(DataFlow::Node source) { source instanceof RemoteFlowSource }
42+
predicate isSource(DataFlow::Node source) {
43+
source instanceof RemoteFlowSource and
44+
not source.(RemoteFlowSource).getSourceType() = "branch"
45+
}
4346

4447
predicate isSink(DataFlow::Node sink) { sink instanceof EnvVarInjectionSink }
4548
}

‎ql/src/Security/CWE-077/EnvPathInjection.ql

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -20,8 +20,10 @@ from EnvPathInjectionFlow::PathNode source, EnvPathInjectionFlow::PathNode sink
2020
where
2121
EnvPathInjectionFlow::flowPath(source, sink) and
2222
(
23+
// sink belongs to a composite action
2324
exists(sink.getNode().asExpr().getEnclosingCompositeAction())
2425
or
26+
// sink belongs to a non-privileged job
2527
exists(Job j |
2628
j = sink.getNode().asExpr().getEnclosingJob() and
2729
not j.isPrivileged()

‎ql/src/Security/CWE-077/EnvVarInjection.ql

Lines changed: 13 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -16,23 +16,29 @@ import actions
1616
import codeql.actions.security.EnvVarInjectionQuery
1717
import EnvVarInjectionFlow::PathGraph
1818

19+
predicate artifactToFileRead(DataFlow::Node source, DataFlow::Node sink) {
20+
(
21+
not source.(RemoteFlowSource).getSourceType() = "artifact"
22+
or
23+
source.(RemoteFlowSource).getSourceType() = "artifact" and
24+
sink instanceof EnvVarInjectionFromFileReadSink
25+
)
26+
}
27+
1928
from EnvVarInjectionFlow::PathNode source, EnvVarInjectionFlow::PathNode sink
2029
where
2130
EnvVarInjectionFlow::flowPath(source, sink) and
2231
(
32+
// sink belongs to a composite action
2333
exists(sink.getNode().asExpr().getEnclosingCompositeAction())
2434
or
35+
// sink belongs to a non-privileged job
2536
exists(Job j |
2637
j = sink.getNode().asExpr().getEnclosingJob() and
2738
not j.isPrivileged()
2839
) and
29-
(
30-
not source.getNode().(RemoteFlowSource).getSourceType() = "artifact"
31-
or
32-
source.getNode().(RemoteFlowSource).getSourceType() = "artifact" and
33-
sink.getNode() instanceof EnvVarInjectionFromFileReadSink
34-
) and
35-
not source.getNode().(RemoteFlowSource).getSourceType() = "branch"
40+
// exclude paths to file read sinks from non-artifact sources
41+
artifactToFileRead(source.getNode(), sink.getNode())
3642
)
3743
select sink.getNode(), source, sink,
3844
"Potential environment variable injection in $@, which may be controlled by an external user.",

‎ql/src/Security/CWE-077/PrivilegedEnvPathInjection.ql

Lines changed: 2 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -19,10 +19,8 @@ import EnvPathInjectionFlow::PathGraph
1919
from EnvPathInjectionFlow::PathNode source, EnvPathInjectionFlow::PathNode sink
2020
where
2121
EnvPathInjectionFlow::flowPath(source, sink) and
22-
exists(Job j |
23-
j = sink.getNode().asExpr().getEnclosingJob() and
24-
j.isPrivileged()
25-
) and
22+
// sink belongs to a privileged job
23+
sink.getNode().asExpr().getEnclosingJob().isPrivileged() and
2624
(
2725
not source.getNode().(RemoteFlowSource).getSourceType() = "artifact"
2826
or

‎ql/src/Security/CWE-077/PrivilegedEnvVarInjection.ql

Lines changed: 13 additions & 11 deletions
Original file line numberDiff line numberDiff line change
@@ -16,20 +16,22 @@ import actions
1616
import codeql.actions.security.EnvVarInjectionQuery
1717
import EnvVarInjectionFlow::PathGraph
1818

19+
predicate artifactToFileRead(DataFlow::Node source, DataFlow::Node sink) {
20+
(
21+
not source.(RemoteFlowSource).getSourceType() = "artifact"
22+
or
23+
source.(RemoteFlowSource).getSourceType() = "artifact" and
24+
sink instanceof EnvVarInjectionFromFileReadSink
25+
)
26+
}
27+
1928
from EnvVarInjectionFlow::PathNode source, EnvVarInjectionFlow::PathNode sink
2029
where
2130
EnvVarInjectionFlow::flowPath(source, sink) and
22-
exists(Job j |
23-
j = sink.getNode().asExpr().getEnclosingJob() and
24-
j.isPrivileged()
25-
) and
26-
(
27-
not source.getNode().(RemoteFlowSource).getSourceType() = "artifact"
28-
or
29-
source.getNode().(RemoteFlowSource).getSourceType() = "artifact" and
30-
sink.getNode() instanceof EnvVarInjectionFromFileReadSink
31-
) and
32-
not source.getNode().(RemoteFlowSource).getSourceType() = "branch"
31+
// sink belongs to a privileged job
32+
sink.getNode().asExpr().getEnclosingJob().isPrivileged() and
33+
// exclude paths to file read sinks from non-artifact sources
34+
artifactToFileRead(source.getNode(), sink.getNode())
3335
select sink.getNode(), source, sink,
3436
"Potential privileged environment variable injection in $@, which may be controlled by an external user.",
3537
sink, sink.getNode().toString()

‎ql/test/query-tests/Security/CWE-077/.github/workflows/test4.yml

Lines changed: 8 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -42,12 +42,19 @@ jobs:
4242
- env:
4343
TITLE: ${{ github.event.pull_request.title }}
4444
run: |
45-
cat <<-"EOF" >> "$GITHUB_ENV"
45+
cat <<-EOF >> "$GITHUB_ENV"
4646
echo "FOO=$TITLE"
4747
EOF
4848
- env:
4949
TITLE: ${{ github.event.pull_request.head.ref }}
5050
run: |
5151
echo "PR_TITLE=$TITLE" >> $GITHUB_ENV
52+
- run: echo "BRANCH=$(echo ${TARGET_BRANCH##*/})" >> $GITHUB_ENV
53+
env:
54+
TARGET_BRANCH: ${{ github.head_ref }}
55+
- run: echo "BRANCH=$(echo ${TARGET_BRANCH##*/})" >> $GITHUB_ENV
56+
env:
57+
TARGET_BRANCH: ${{ github.event.pull_request.title }}
58+
5259

5360

‎ql/test/query-tests/Security/CWE-077/EnvVarInjection.expected

Lines changed: 6 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -7,7 +7,8 @@ edges
77
| .github/workflows/test4.yml:23:19:23:56 | github.event.pull_request.title | .github/workflows/test4.yml:24:14:27:36 | echo "PR_TITLE<<EOF" >> $GITHUB_ENV\necho "$TITLE" >> $GITHUB_ENV\necho "EOF" >> $GITHUB_ENV\n |
88
| .github/workflows/test4.yml:29:19:29:56 | github.event.pull_request.title | .github/workflows/test4.yml:30:14:33:40 | echo "PACKAGES_FILE_LIST<<EOF" >> "${GITHUB_ENV}"\necho "$TITLE" >> "${GITHUB_ENV}"\necho "EOF" >> "${GITHUB_ENV}"\n |
99
| .github/workflows/test4.yml:35:19:35:56 | github.event.pull_request.title | .github/workflows/test4.yml:36:14:41:29 | {\n echo 'JSON_RESPONSE<<EOF'\n echo "$TITLE" >> "$GITHUB_ENV"\n echo EOF\n} >> "$GITHUB_ENV"\n |
10-
| .github/workflows/test4.yml:49:19:49:59 | github.event.pull_request.head.ref | .github/workflows/test4.yml:50:14:51:48 | echo "PR_TITLE=$TITLE" >> $GITHUB_ENV\n |
10+
| .github/workflows/test4.yml:43:19:43:56 | github.event.pull_request.title | .github/workflows/test4.yml:44:14:47:14 | cat <<-EOF >> "$GITHUB_ENV"\n echo "FOO=$TITLE"\nEOF\n |
11+
| .github/workflows/test4.yml:57:27:57:64 | github.event.pull_request.title | .github/workflows/test4.yml:55:14:55:70 | echo "BRANCH=$(echo ${TARGET_BRANCH##*/})" >> $GITHUB_ENV |
1112
| .github/workflows/test5.yml:10:9:30:6 | Uses Step | .github/workflows/test5.yml:33:14:36:62 | echo "PR_NUM=$(cat coverage/pr_num.txt)" >> $GITHUB_ENV\necho "BASE=$(cat coverage/base.txt)" >> $GITHUB_ENV\necho "HEAD=$(cat coverage/head.txt)" >> $GITHUB_ENV\n |
1213
nodes
1314
| .github/workflows/test2.yml:12:9:41:6 | Uses Step | semmle.label | Uses Step |
@@ -26,8 +27,10 @@ nodes
2627
| .github/workflows/test4.yml:30:14:33:40 | echo "PACKAGES_FILE_LIST<<EOF" >> "${GITHUB_ENV}"\necho "$TITLE" >> "${GITHUB_ENV}"\necho "EOF" >> "${GITHUB_ENV}"\n | semmle.label | echo "PACKAGES_FILE_LIST<<EOF" >> "${GITHUB_ENV}"\necho "$TITLE" >> "${GITHUB_ENV}"\necho "EOF" >> "${GITHUB_ENV}"\n |
2728
| .github/workflows/test4.yml:35:19:35:56 | github.event.pull_request.title | semmle.label | github.event.pull_request.title |
2829
| .github/workflows/test4.yml:36:14:41:29 | {\n echo 'JSON_RESPONSE<<EOF'\n echo "$TITLE" >> "$GITHUB_ENV"\n echo EOF\n} >> "$GITHUB_ENV"\n | semmle.label | {\n echo 'JSON_RESPONSE<<EOF'\n echo "$TITLE" >> "$GITHUB_ENV"\n echo EOF\n} >> "$GITHUB_ENV"\n |
29-
| .github/workflows/test4.yml:49:19:49:59 | github.event.pull_request.head.ref | semmle.label | github.event.pull_request.head.ref |
30-
| .github/workflows/test4.yml:50:14:51:48 | echo "PR_TITLE=$TITLE" >> $GITHUB_ENV\n | semmle.label | echo "PR_TITLE=$TITLE" >> $GITHUB_ENV\n |
30+
| .github/workflows/test4.yml:43:19:43:56 | github.event.pull_request.title | semmle.label | github.event.pull_request.title |
31+
| .github/workflows/test4.yml:44:14:47:14 | cat <<-EOF >> "$GITHUB_ENV"\n echo "FOO=$TITLE"\nEOF\n | semmle.label | cat <<-EOF >> "$GITHUB_ENV"\n echo "FOO=$TITLE"\nEOF\n |
32+
| .github/workflows/test4.yml:55:14:55:70 | echo "BRANCH=$(echo ${TARGET_BRANCH##*/})" >> $GITHUB_ENV | semmle.label | echo "BRANCH=$(echo ${TARGET_BRANCH##*/})" >> $GITHUB_ENV |
33+
| .github/workflows/test4.yml:57:27:57:64 | github.event.pull_request.title | semmle.label | github.event.pull_request.title |
3134
| .github/workflows/test5.yml:10:9:30:6 | Uses Step | semmle.label | Uses Step |
3235
| .github/workflows/test5.yml:33:14:36:62 | echo "PR_NUM=$(cat coverage/pr_num.txt)" >> $GITHUB_ENV\necho "BASE=$(cat coverage/base.txt)" >> $GITHUB_ENV\necho "HEAD=$(cat coverage/head.txt)" >> $GITHUB_ENV\n | semmle.label | echo "PR_NUM=$(cat coverage/pr_num.txt)" >> $GITHUB_ENV\necho "BASE=$(cat coverage/base.txt)" >> $GITHUB_ENV\necho "HEAD=$(cat coverage/head.txt)" >> $GITHUB_ENV\n |
3336
subpaths

‎ql/test/query-tests/Security/CWE-077/PrivilegedEnvVarInjection.expected

Lines changed: 8 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -7,7 +7,8 @@ edges
77
| .github/workflows/test4.yml:23:19:23:56 | github.event.pull_request.title | .github/workflows/test4.yml:24:14:27:36 | echo "PR_TITLE<<EOF" >> $GITHUB_ENV\necho "$TITLE" >> $GITHUB_ENV\necho "EOF" >> $GITHUB_ENV\n |
88
| .github/workflows/test4.yml:29:19:29:56 | github.event.pull_request.title | .github/workflows/test4.yml:30:14:33:40 | echo "PACKAGES_FILE_LIST<<EOF" >> "${GITHUB_ENV}"\necho "$TITLE" >> "${GITHUB_ENV}"\necho "EOF" >> "${GITHUB_ENV}"\n |
99
| .github/workflows/test4.yml:35:19:35:56 | github.event.pull_request.title | .github/workflows/test4.yml:36:14:41:29 | {\n echo 'JSON_RESPONSE<<EOF'\n echo "$TITLE" >> "$GITHUB_ENV"\n echo EOF\n} >> "$GITHUB_ENV"\n |
10-
| .github/workflows/test4.yml:49:19:49:59 | github.event.pull_request.head.ref | .github/workflows/test4.yml:50:14:51:48 | echo "PR_TITLE=$TITLE" >> $GITHUB_ENV\n |
10+
| .github/workflows/test4.yml:43:19:43:56 | github.event.pull_request.title | .github/workflows/test4.yml:44:14:47:14 | cat <<-EOF >> "$GITHUB_ENV"\n echo "FOO=$TITLE"\nEOF\n |
11+
| .github/workflows/test4.yml:57:27:57:64 | github.event.pull_request.title | .github/workflows/test4.yml:55:14:55:70 | echo "BRANCH=$(echo ${TARGET_BRANCH##*/})" >> $GITHUB_ENV |
1112
| .github/workflows/test5.yml:10:9:30:6 | Uses Step | .github/workflows/test5.yml:33:14:36:62 | echo "PR_NUM=$(cat coverage/pr_num.txt)" >> $GITHUB_ENV\necho "BASE=$(cat coverage/base.txt)" >> $GITHUB_ENV\necho "HEAD=$(cat coverage/head.txt)" >> $GITHUB_ENV\n |
1213
nodes
1314
| .github/workflows/test2.yml:12:9:41:6 | Uses Step | semmle.label | Uses Step |
@@ -26,8 +27,10 @@ nodes
2627
| .github/workflows/test4.yml:30:14:33:40 | echo "PACKAGES_FILE_LIST<<EOF" >> "${GITHUB_ENV}"\necho "$TITLE" >> "${GITHUB_ENV}"\necho "EOF" >> "${GITHUB_ENV}"\n | semmle.label | echo "PACKAGES_FILE_LIST<<EOF" >> "${GITHUB_ENV}"\necho "$TITLE" >> "${GITHUB_ENV}"\necho "EOF" >> "${GITHUB_ENV}"\n |
2728
| .github/workflows/test4.yml:35:19:35:56 | github.event.pull_request.title | semmle.label | github.event.pull_request.title |
2829
| .github/workflows/test4.yml:36:14:41:29 | {\n echo 'JSON_RESPONSE<<EOF'\n echo "$TITLE" >> "$GITHUB_ENV"\n echo EOF\n} >> "$GITHUB_ENV"\n | semmle.label | {\n echo 'JSON_RESPONSE<<EOF'\n echo "$TITLE" >> "$GITHUB_ENV"\n echo EOF\n} >> "$GITHUB_ENV"\n |
29-
| .github/workflows/test4.yml:49:19:49:59 | github.event.pull_request.head.ref | semmle.label | github.event.pull_request.head.ref |
30-
| .github/workflows/test4.yml:50:14:51:48 | echo "PR_TITLE=$TITLE" >> $GITHUB_ENV\n | semmle.label | echo "PR_TITLE=$TITLE" >> $GITHUB_ENV\n |
30+
| .github/workflows/test4.yml:43:19:43:56 | github.event.pull_request.title | semmle.label | github.event.pull_request.title |
31+
| .github/workflows/test4.yml:44:14:47:14 | cat <<-EOF >> "$GITHUB_ENV"\n echo "FOO=$TITLE"\nEOF\n | semmle.label | cat <<-EOF >> "$GITHUB_ENV"\n echo "FOO=$TITLE"\nEOF\n |
32+
| .github/workflows/test4.yml:55:14:55:70 | echo "BRANCH=$(echo ${TARGET_BRANCH##*/})" >> $GITHUB_ENV | semmle.label | echo "BRANCH=$(echo ${TARGET_BRANCH##*/})" >> $GITHUB_ENV |
33+
| .github/workflows/test4.yml:57:27:57:64 | github.event.pull_request.title | semmle.label | github.event.pull_request.title |
3134
| .github/workflows/test5.yml:10:9:30:6 | Uses Step | semmle.label | Uses Step |
3235
| .github/workflows/test5.yml:33:14:36:62 | echo "PR_NUM=$(cat coverage/pr_num.txt)" >> $GITHUB_ENV\necho "BASE=$(cat coverage/base.txt)" >> $GITHUB_ENV\necho "HEAD=$(cat coverage/head.txt)" >> $GITHUB_ENV\n | semmle.label | echo "PR_NUM=$(cat coverage/pr_num.txt)" >> $GITHUB_ENV\necho "BASE=$(cat coverage/base.txt)" >> $GITHUB_ENV\necho "HEAD=$(cat coverage/head.txt)" >> $GITHUB_ENV\n |
3336
subpaths
@@ -40,4 +43,6 @@ subpaths
4043
| .github/workflows/test4.yml:24:14:27:36 | echo "PR_TITLE<<EOF" >> $GITHUB_ENV\necho "$TITLE" >> $GITHUB_ENV\necho "EOF" >> $GITHUB_ENV\n | .github/workflows/test4.yml:23:19:23:56 | github.event.pull_request.title | .github/workflows/test4.yml:24:14:27:36 | echo "PR_TITLE<<EOF" >> $GITHUB_ENV\necho "$TITLE" >> $GITHUB_ENV\necho "EOF" >> $GITHUB_ENV\n | Potential privileged environment variable injection in $@, which may be controlled by an external user. | .github/workflows/test4.yml:24:14:27:36 | echo "PR_TITLE<<EOF" >> $GITHUB_ENV\necho "$TITLE" >> $GITHUB_ENV\necho "EOF" >> $GITHUB_ENV\n | echo "PR_TITLE<<EOF" >> $GITHUB_ENV\necho "$TITLE" >> $GITHUB_ENV\necho "EOF" >> $GITHUB_ENV\n |
4144
| .github/workflows/test4.yml:30:14:33:40 | echo "PACKAGES_FILE_LIST<<EOF" >> "${GITHUB_ENV}"\necho "$TITLE" >> "${GITHUB_ENV}"\necho "EOF" >> "${GITHUB_ENV}"\n | .github/workflows/test4.yml:29:19:29:56 | github.event.pull_request.title | .github/workflows/test4.yml:30:14:33:40 | echo "PACKAGES_FILE_LIST<<EOF" >> "${GITHUB_ENV}"\necho "$TITLE" >> "${GITHUB_ENV}"\necho "EOF" >> "${GITHUB_ENV}"\n | Potential privileged environment variable injection in $@, which may be controlled by an external user. | .github/workflows/test4.yml:30:14:33:40 | echo "PACKAGES_FILE_LIST<<EOF" >> "${GITHUB_ENV}"\necho "$TITLE" >> "${GITHUB_ENV}"\necho "EOF" >> "${GITHUB_ENV}"\n | echo "PACKAGES_FILE_LIST<<EOF" >> "${GITHUB_ENV}"\necho "$TITLE" >> "${GITHUB_ENV}"\necho "EOF" >> "${GITHUB_ENV}"\n |
4245
| .github/workflows/test4.yml:36:14:41:29 | {\n echo 'JSON_RESPONSE<<EOF'\n echo "$TITLE" >> "$GITHUB_ENV"\n echo EOF\n} >> "$GITHUB_ENV"\n | .github/workflows/test4.yml:35:19:35:56 | github.event.pull_request.title | .github/workflows/test4.yml:36:14:41:29 | {\n echo 'JSON_RESPONSE<<EOF'\n echo "$TITLE" >> "$GITHUB_ENV"\n echo EOF\n} >> "$GITHUB_ENV"\n | Potential privileged environment variable injection in $@, which may be controlled by an external user. | .github/workflows/test4.yml:36:14:41:29 | {\n echo 'JSON_RESPONSE<<EOF'\n echo "$TITLE" >> "$GITHUB_ENV"\n echo EOF\n} >> "$GITHUB_ENV"\n | {\n echo 'JSON_RESPONSE<<EOF'\n echo "$TITLE" >> "$GITHUB_ENV"\n echo EOF\n} >> "$GITHUB_ENV"\n |
46+
| .github/workflows/test4.yml:44:14:47:14 | cat <<-EOF >> "$GITHUB_ENV"\n echo "FOO=$TITLE"\nEOF\n | .github/workflows/test4.yml:43:19:43:56 | github.event.pull_request.title | .github/workflows/test4.yml:44:14:47:14 | cat <<-EOF >> "$GITHUB_ENV"\n echo "FOO=$TITLE"\nEOF\n | Potential privileged environment variable injection in $@, which may be controlled by an external user. | .github/workflows/test4.yml:44:14:47:14 | cat <<-EOF >> "$GITHUB_ENV"\n echo "FOO=$TITLE"\nEOF\n | cat <<-EOF >> "$GITHUB_ENV"\n echo "FOO=$TITLE"\nEOF\n |
47+
| .github/workflows/test4.yml:55:14:55:70 | echo "BRANCH=$(echo ${TARGET_BRANCH##*/})" >> $GITHUB_ENV | .github/workflows/test4.yml:57:27:57:64 | github.event.pull_request.title | .github/workflows/test4.yml:55:14:55:70 | echo "BRANCH=$(echo ${TARGET_BRANCH##*/})" >> $GITHUB_ENV | Potential privileged environment variable injection in $@, which may be controlled by an external user. | .github/workflows/test4.yml:55:14:55:70 | echo "BRANCH=$(echo ${TARGET_BRANCH##*/})" >> $GITHUB_ENV | echo "BRANCH=$(echo ${TARGET_BRANCH##*/})" >> $GITHUB_ENV |
4348
| .github/workflows/test5.yml:33:14:36:62 | echo "PR_NUM=$(cat coverage/pr_num.txt)" >> $GITHUB_ENV\necho "BASE=$(cat coverage/base.txt)" >> $GITHUB_ENV\necho "HEAD=$(cat coverage/head.txt)" >> $GITHUB_ENV\n | .github/workflows/test5.yml:10:9:30:6 | Uses Step | .github/workflows/test5.yml:33:14:36:62 | echo "PR_NUM=$(cat coverage/pr_num.txt)" >> $GITHUB_ENV\necho "BASE=$(cat coverage/base.txt)" >> $GITHUB_ENV\necho "HEAD=$(cat coverage/head.txt)" >> $GITHUB_ENV\n | Potential privileged environment variable injection in $@, which may be controlled by an external user. | .github/workflows/test5.yml:33:14:36:62 | echo "PR_NUM=$(cat coverage/pr_num.txt)" >> $GITHUB_ENV\necho "BASE=$(cat coverage/base.txt)" >> $GITHUB_ENV\necho "HEAD=$(cat coverage/head.txt)" >> $GITHUB_ENV\n | echo "PR_NUM=$(cat coverage/pr_num.txt)" >> $GITHUB_ENV\necho "BASE=$(cat coverage/base.txt)" >> $GITHUB_ENV\necho "HEAD=$(cat coverage/head.txt)" >> $GITHUB_ENV\n |

0 commit comments

Comments
 (0)