Skip to content

Commit bdff510

Browse files
[SECURITY] Fix for CWE-20 regression caused by security hardening.
Changes in file .github/actions/check-control/action.yml: * fix CWE-20 from double escapping quotes Changes in file .github/actions/run-minimal-acceptance-tests/action.yml: * fix CWE-20 from double escapping quotes Changes in file .github/actions/setup-py-reqs/action.yml: * fix CWE-20 from double escapping quotes
1 parent f2a78ac commit bdff510

File tree

3 files changed

+3
-3
lines changed

3 files changed

+3
-3
lines changed

.github/actions/check-control/action.yml

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -114,7 +114,7 @@ runs:
114114
sha_input='${{ inputs.sha }}'
115115
if [[ ! "$sha_input" =~ ^[0-9a-f]{40}$ ]]; then
116116
# check if value is non-sha valid
117-
output=$(git rev-parse --verify "$sha_input")
117+
output=$(git rev-parse --verify $sha_input)
118118
if [[ -n "$output" ]]; then
119119
printf "::debug:: %s\n" "Valid branch name or sha provided: ${output}" ;
120120
else

.github/actions/run-minimal-acceptance-tests/action.yml

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -87,7 +87,7 @@ runs:
8787
sha_input='${{ inputs.sha }}'
8888
if [[ ! "$sha_input" =~ ^[0-9a-f]{40}$ ]]; then
8989
# check if value is non-sha valid
90-
output=$(git rev-parse --verify "$sha_input")
90+
output=$(git rev-parse --verify $sha_input 2>/dev/null)
9191
if [[ -n "$output" ]]; then
9292
printf "::debug:: %s\n" "Valid branch name or sha provided: ${output}" ;
9393
else

.github/actions/setup-py-reqs/action.yml

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -72,7 +72,7 @@ runs:
7272
sha_input='${{ inputs.sha }}'
7373
if [[ ! "$sha_input" =~ ^[0-9a-f]{40}$ ]]; then
7474
# check if value is non-sha valid
75-
output=$(git rev-parse --verify "$sha_input")
75+
output=$(git rev-parse --verify $sha_input 2>/dev/null)
7676
if [[ -n "$output" ]]; then
7777
printf "::debug:: %s\n" "Valid branch name or sha provided: ${output}" ;
7878
else

0 commit comments

Comments
 (0)