Fix an issue with untrusted input (#1873)

* Fix an issue with untrusted input

* feedback

Author: khmMouna

.github/workflows/deploy-docs-to-pages.yml

@@ -34,26 +34,34 @@ jobs:
     steps:
       - name: Extract version
         id: extract_version
+        env:
+          VERSION: ${{ inputs.version }}
         run: |
-          VERSION=${{ inputs.version }}
+          set -euo pipefail
           MAJOR_VERSION=$(echo "$VERSION" | cut -d. -f1)
           echo "VERSION_DIR=v$MAJOR_VERSION" >> $GITHUB_ENV
 
       - name: Download packaged docs artifacts
         id: download_docs
+        env:
+          VERSION: ${{ inputs.version }}
         uses: actions/download-artifact@v4
         with:
-          name: packaged-docs-${{ inputs.version }}
+          name: packaged-docs-$VERSION
           path: build/docs
 
       - name: Extract documentation for GitHub Pages
         env:
           VERSION: ${{ inputs.version }}
         run: |
           # Verify the artifact was downloaded
-          if [ ! -f "build/docs/$VERSION-kdoc.tar.gz" ]; then
+          set -euo pipefail
+
+          DOC_PATH="build/docs/${VERSION}-kdoc.tar.gz"
+
+          if [ ! -f "$DOC_PATH" ]; then
             echo "Error: Documentation artifact not found!"
-            echo "Expected: build/docs/$VERSION-kdoc.tar.gz"
+            echo "Expected: $DOC_PATH"
             echo "Available files:"
             find build/docs -type f 2>/dev/null || echo "No build/docs directory found"
             exit 1
@@ -63,7 +71,7 @@ jobs:
           mkdir -p ./pages-docs
           
           # Extract the tar.gz file
-          tar -xzf build/docs/$VERSION-kdoc.tar.gz -C ./pages-docs
+          tar -xzf "$DOC_PATH" -C ./pages-docs
           
           # Verify extraction was successful
           if [ -z "$(ls -A ./pages-docs)" ]; then
@@ -77,10 +85,12 @@ jobs:
 
       - name: Deploy to GitHub Pages
         uses: peaceiris/actions-gh-pages@v4
+        env:
+          VERSION: ${{ inputs.version }}
         with:
           github_token: ${{ secrets.GITHUB_TOKEN }}
           publish_branch: gh-pages
           publish_dir: ./pages-docs
-          destination_dir: ${{ inputs.version }}
+          destination_dir: $VERSION
           keep_files: true
           enable_jekyll: false

.github/workflows/publish-docs.yml

@@ -27,19 +27,23 @@ jobs:
       # Download pre-packaged docs artifacts if they were published by the release workflow.
       - name: Download pre-packaged docs artifacts
         id: download_docs
+        env:
+          VERSION: ${{ inputs.version }}
         uses: actions/download-artifact@v4
         continue-on-error: true
         with:
-          name: packaged-docs-${{ inputs.version }}
+          name: packaged-docs-$VERSION
           path: build/docs
 
       # Fallback to building if artifacts were not previously uploaded for the given version.
       # NOTE: All the steps below this point will be skipped if the download step succeeds.
       - name: Checkout repo to build docs
         if: ${{ steps.download_docs.outcome == 'failure' }}
+        env:
+          VERSION: ${{ inputs.version }}
         uses: actions/checkout@v4
         with:
-          ref: refs/tags/${{ inputs.version }}
+          ref: refs/tags/$VERSION
 
       - name: Setup Java Version
         uses: actions/setup-java@v4
@@ -52,29 +56,46 @@ jobs:
 
       - name: Copy CI gradle.properties
         if: ${{ steps.download_docs.outcome == 'failure' }}
+        env:
+          VERSION: ${{ inputs.version }}
         run: |
+          set -euo pipefail
           mkdir -p ~/.gradle
           cp .github/ci-gradle.properties ~/.gradle/gradle.properties
 
-      - name: Verify Version
+      - name: Verify Version (Gradle equality)
         if: ${{ steps.download_docs.outcome == 'failure' }}
+        env:
+          VERSION: ${{ inputs.version }}
         run: |
-          VERSION=${{ inputs.version }}
-          if [[ $(./gradlew -q getVersion) = $VERSION ]]; then exit 0 ; else exit 1; fi
+          set -euo pipefail
+          ACTUAL_VERSION=$(./gradlew -q getVersion)
+
+          if [[ "$ACTUAL_VERSION" != "$VERSION" ]]; then
+            echo "Gradle version mismatch: expected '$VERSION', got '$ACTUAL_VERSION'" >&2
+            exit 1
+          fi
+
+          echo "Verified version matches Gradle: $VERSION"
 
       - name: Build docs packages
         if: ${{ steps.download_docs.outcome == 'failure' }}
+        env:
+          VERSION: ${{ inputs.version }}
         run: |
+          set -euo pipefail
           ./gradlew packageDocs --stacktrace
 
       - name: Upload packaged docs artifacts
         if: ${{ steps.download_docs.outcome == 'failure' }}
+        env:
+          VERSION: ${{ inputs.version }}
         uses: actions/upload-artifact@v4
         with:
-          name: packaged-docs-${{ inputs.version }}
+          name: packaged-docs-$VERSION
           retention-days: 1
           path: |
-            build/docs/${{ inputs.version }}-kdoc.tar.gz
+            build/docs/$VERSION-kdoc.tar.gz
 
   upload-docs:
     if: github.repository == 'urbanairship/android-library'
@@ -84,15 +105,19 @@ jobs:
       # Docs should already be built and uploaded at this point, but we still need
       # this step in order for google-github-actions/auth to work in upload step.
       - name: Checkout repo
+        env:
+          VERSION: ${{ inputs.version }}
         uses: actions/checkout@v4
         with:
-          ref: refs/tags/${{ inputs.version }}
+          ref: refs/tags/$VERSION
 
       - name: Download packaged docs artifacts
         id: download_docs
+        env:
+          VERSION: ${{ inputs.version }}
         uses: actions/download-artifact@v4
         with:
-          name: packaged-docs-${{ inputs.version }}
+          name: packaged-docs-$VERSION
           path: build/docs
 
       - name: Setup GCP Auth
@@ -108,4 +133,6 @@ jobs:
         env:
             VERSION: ${{ inputs.version }}
         run: |
-          gsutil cp build/docs/$VERSION-kdoc.tar.gz gs://ua-web-ci-prod-docs-transfer/libraries/android-kotlin/$VERSION.tar.gz
+          set -euo pipefail
+          gsutil cp "build/docs/${VERSION}-kdoc.tar.gz" \
+            "gs://ua-web-ci-prod-docs-transfer/libraries/android-kotlin/${VERSION}.tar.gz"