Skip to content

Commit 8c2ff9e

Browse files
Security: Fix untrusted input vulnerability in release workflow
1 parent b6f1bba commit 8c2ff9e

File tree

1 file changed

+4
-12
lines changed

1 file changed

+4
-12
lines changed

.github/workflows/release.yml

Lines changed: 4 additions & 12 deletions
Original file line numberDiff line numberDiff line change
@@ -10,25 +10,17 @@ jobs:
1010
name: Publish changelog to Readme
1111
runs-on: ubuntu-latest
1212
steps:
13-
- name: Extract release data
14-
id: release
15-
run: |
16-
echo "title=${{ github.event.release.name }}" >> $GITHUB_OUTPUT
17-
{
18-
echo "body<<EOF"
19-
echo "${{ github.event.release.body }}"
20-
echo "EOF"
21-
} >> $GITHUB_OUTPUT
22-
2313
- name: Install jq
2414
run: sudo apt-get update && sudo apt-get install -y jq
2515

2616
- name: Publish changelog to Readme
2717
env:
2818
README_API_KEY: ${{ secrets.README_API_KEY }}
19+
RELEASE_TITLE: ${{ github.event.release.name }}
20+
RELEASE_BODY: ${{ github.event.release.body }}
2921
run: |
30-
jq -n --arg title "Java Unified SDK ${{ steps.release.outputs.title }}" \
31-
--arg body "${{ steps.release.outputs.body }}" \
22+
jq -n --arg title "Java Unified SDK $RELEASE_TITLE" \
23+
--arg body "$RELEASE_BODY" \
3224
'{
3325
title: $title,
3426
content: {

0 commit comments

Comments
 (0)