ci: sanitize target input to prevent template injection in build build-matrix action - #12259
ci: sanitize target input to prevent template injection in build build-matrix action#12259stu10887 wants to merge 2 commits into
Conversation
|
No actionable comments were generated in the recent review. 🎉 ℹ️ Recent review info⚙️ Run configurationConfiguration used: defaults Review profile: CHILL Plan: Pro Plus Run ID: 📒 Files selected for processing (1)
🚧 Files skipped from review as they are similar to previous changes (1)
📝 WalkthroughWalkthroughThe package build matrix action passes the manual target through ChangesPackage build matrix
Estimated code review effort: 2 (Simple) | ~10 minutes Suggested labels: Suggested reviewers: 🚥 Pre-merge checks | ✅ 5✅ Passed checks (5 passed)
✨ Finishing Touches🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 1
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In @.github/actions/generate-package-build-matrix/action.yaml:
- Around line 102-106: Update the matrix construction around TARGET_INPUT to
pass the value through jq --arg and generate the distro array from that
argument, rather than interpolating raw shell text into JSON. Preserve the
existing compact matrix output and ensure quotes, backslashes, newlines, and
delimiter-like content remain a single valid distro entry.
🪄 Autofix
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: defaults
Review profile: CHILL
Plan: Pro Plus
Run ID: f39a64c5-753b-40e8-8f35-8d641524255d
📒 Files selected for processing (1)
.github/actions/generate-package-build-matrix/action.yaml
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 85a357c567
ℹ️ About Codex in GitHub
Codex has been enabled to automatically review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
When you sign up for Codex through ChatGPT, Codex can also answer questions or update the PR, like "@codex address that feedback".
| matrix=$(( | ||
| echo '{ "distro" : [' | ||
| echo '"${{ inputs.target }}"' | ||
| echo "\"$TARGET_INPUT\"" |
There was a problem hiding this comment.
In the manual staging-build dispatch path, this still serializes raw TARGET_INPUT into the matrix instead of JSON-encoding or validating it. For example, a target containing a JSON delimiter such as ubuntu/20.04", "centos/7 makes the override expand into multiple matrix.distro entries before call-build-linux-packages.yaml consumes it with fromJSON, so the input is not constrained to the single build target described by the action; build the matrix with jq --arg and reject values outside the known target set.
Useful? React with 👍 / 👎.
There was a problem hiding this comment.
Applied the jq --arg refactor to safely handle string encoding and JSON generation. Thanks for the suggestion!
…ON matrix generation for target input Signed-off-by: Stuart Rodgers <stu10887@gmail.com> Signed-off-by: Stu <stu10887@gmail.com>
|
Applied the jq --arg refactor to safely handle string encoding and JSON generation. And marked the PR as ready for review. |
1 participant
Summary
This PR remediates a high-confidence GitHub Actions template injection risk (
template-injection) in.github/actions/generate-package-build-matrix/action.yaml.Security Impact
Direct inline expansion of
${{ inputs.target }}insiderun:shell blocks allows potential code execution if user inputs contain shell metacharacters.By mapping
${{ inputs.target }}to an intermediate environment variable (TARGET_INPUT) under anenv:block, GitHub Actions safely escapes the input string prior to shell execution.Changes Made
env: TARGET_INPUT: ${{ inputs.target }}to theManual override of targetstep.${{ inputs.target }}expansions in therun:script with safe environment variable references ($TARGET_INPUT).zizmor;error[template-injection]findings are resolved.Testing & Validation
zizmorlocally against.github/actions/generate-package-build-matrix/action.yaml.Summary by CodeRabbit