mirror of
https://github.com/electron/electron.git
synced 2026-04-10 03:01:51 -04:00
9928c7d828
* fix: harden GitHub Actions against script injection vulnerabilities
Replace direct ${{ }} expression interpolation in run: blocks with
environment variables to prevent script injection attacks. Changes:
- archaeologist-dig.yml: move clone_url, head.sha, base.ref to env vars
- non-maintainer-dependency-change.yml: move user.login to env var
- issue-unlabeled.yml: move toJSON(labels) to env var
- issue-labeled.yml: move issue.number to env var
- pipeline-electron-lint.yml: validate chromium_revision format
- cipd-install/action.yml: move all inputs to env vars and quote them
- set-chromium-cookie/action.yml: reference secrets via $ENV_VAR
- Add security comments to all 5 pull_request_target workflows
https://claude.ai/code/session_01UUWmLxn5hyyxrhK8rGxU2s
* fix: allow version strings in chromium_revision validation
The previous regex `^[a-f0-9]+$` only matched git SHAs but
chromium_revision is a version string like `148.0.7741.0`.
Broaden to `^[a-zA-Z0-9._-]+$` which still blocks shell
metacharacters.
https://claude.ai/code/session_01UUWmLxn5hyyxrhK8rGxU2s
---------
Co-authored-by: Claude <noreply@anthropic.com>
72 lines
2.8 KiB
YAML
72 lines
2.8 KiB
YAML
name: 'CIPD install'
|
|
description: 'Installs the specified CIPD package'
|
|
inputs:
|
|
cipd-root-prefix-path:
|
|
description: 'Path to prepend to installation directory'
|
|
default: ''
|
|
dependency:
|
|
description: 'Name of dependency to install'
|
|
deps-file:
|
|
description: 'Location of DEPS file that defines the dependency'
|
|
installation-dir:
|
|
description: 'Location to install dependency'
|
|
target-platform:
|
|
description: 'Target platform, should be linux, win, macos'
|
|
package:
|
|
description: 'Package to install'
|
|
dependency-version:
|
|
description: 'Version of the dependency to install'
|
|
default: ''
|
|
runs:
|
|
using: "composite"
|
|
steps:
|
|
- name: Delete wrong ${{ inputs.dependency }}
|
|
shell: bash
|
|
env:
|
|
CIPD_ROOT_PREFIX: ${{ inputs.cipd-root-prefix-path }}
|
|
INSTALLATION_DIR: ${{ inputs.installation-dir }}
|
|
run : |
|
|
rm -rf "${CIPD_ROOT_PREFIX}${INSTALLATION_DIR}"
|
|
- name: Create ensure file for ${{ inputs.dependency }}
|
|
if: ${{ inputs.dependency-version == '' }}
|
|
shell: bash
|
|
env:
|
|
PACKAGE: ${{ inputs.package }}
|
|
DEPS_FILE: ${{ inputs.deps-file }}
|
|
INSTALLATION_DIR: ${{ inputs.installation-dir }}
|
|
DEPENDENCY: ${{ inputs.dependency }}
|
|
run: |
|
|
echo "$PACKAGE" $(e d gclient getdep --deps-file="$DEPS_FILE" -r "${INSTALLATION_DIR}:${PACKAGE}") > "${DEPENDENCY}_ensure_file"
|
|
cat "${DEPENDENCY}_ensure_file"
|
|
|
|
- name: Create ensure file for ${{ inputs.dependency }} from dependency-version
|
|
if: ${{ inputs.dependency-version != '' }}
|
|
shell: bash
|
|
env:
|
|
PACKAGE: ${{ inputs.package }}
|
|
DEPENDENCY_VERSION: ${{ inputs.dependency-version }}
|
|
DEPENDENCY: ${{ inputs.dependency }}
|
|
run: |
|
|
echo "$PACKAGE $DEPENDENCY_VERSION" > "${DEPENDENCY}_ensure_file"
|
|
cat "${DEPENDENCY}_ensure_file"
|
|
- name: CIPD installation of ${{ inputs.dependency }} (macOS)
|
|
if: ${{ inputs.target-platform != 'win' }}
|
|
shell: bash
|
|
env:
|
|
CIPD_ROOT_PREFIX: ${{ inputs.cipd-root-prefix-path }}
|
|
INSTALLATION_DIR: ${{ inputs.installation-dir }}
|
|
DEPENDENCY: ${{ inputs.dependency }}
|
|
run: |
|
|
echo "ensuring $DEPENDENCY"
|
|
e d cipd ensure --root "${CIPD_ROOT_PREFIX}${INSTALLATION_DIR}" -ensure-file "${DEPENDENCY}_ensure_file"
|
|
- name: CIPD installation of ${{ inputs.dependency }} (Windows)
|
|
if: ${{ inputs.target-platform == 'win' }}
|
|
shell: powershell
|
|
env:
|
|
CIPD_ROOT_PREFIX: ${{ inputs.cipd-root-prefix-path }}
|
|
INSTALLATION_DIR: ${{ inputs.installation-dir }}
|
|
DEPENDENCY: ${{ inputs.dependency }}
|
|
run: |
|
|
echo "ensuring $env:DEPENDENCY on Windows"
|
|
e d cipd ensure --root "$env:CIPD_ROOT_PREFIX$env:INSTALLATION_DIR" -ensure-file "$($env:DEPENDENCY)_ensure_file"
|