(logging-parent) 01/01: Improve resilience to script injection

[pk...@apache.org]

This is an automated email from the ASF dual-hosted git repository.

pkarwasz pushed a commit to branch feature/security-hardening
in repository https://gitbox.apache.org/repos/asf/logging-parent.git

commit 913c234207248be4548b169bfc4a00da8407bf7c
Author: Piotr P. Karwasz <pi...@karwasz.org>
AuthorDate: Mon Mar 10 10:27:48 2025 +0100

    Improve resilience to script injection
    
    This change removes all direct usages of GitHub expressions to prevent potential script injections.
    
    **Note**: The GitHub expressions modified in this PR only come from **trusted** sources, so these problems are not exploitable. We wish, however, to prevent possible errors in the future.
---
 .github/workflows/deploy-release-reusable.yaml         | 5 +++--
 .github/workflows/deploy-site.yaml                     | 4 +++-
 .github/workflows/verify-reproducibility-reusable.yaml | 3 ++-
 3 files changed, 8 insertions(+), 4 deletions(-)

diff --git a/.github/workflows/deploy-release-reusable.yaml b/.github/workflows/deploy-release-reusable.yaml
index ec09798..7245e38 100644
--- a/.github/workflows/deploy-release-reusable.yaml
+++ b/.github/workflows/deploy-release-reusable.yaml
@@ -55,6 +55,8 @@ on:
 jobs:
   deploy:
     runs-on: ubuntu-latest
+    env:
+      PROJECT_ID: ${{ inputs.project-id }}
     outputs:
       project-version: ${{ steps.version.outputs.project-version }}
       nexus-url: ${{ steps.nexus.outputs.nexus-url }}
@@ -235,7 +237,7 @@ jobs:
             -DattachmentCount="$DIST_ATTACHMENT_COUNT"
 
           # Rename distribution files
-          export DIST_FILENAME_PREFIX="apache-${{ inputs.project-id }}"
+          export DIST_FILENAME_PREFIX="apache-${PROJECT_ID}"
           export DIST_FILENAME_VERSIONED_PREFIX="${DIST_FILENAME_PREFIX}-${PROJECT_VERSION}"
           export DIST_FILEPATH_PREFIX="/tmp/${DIST_FILENAME_VERSIONED_PREFIX}"
           export DIST_FILEPATH_SRC="${DIST_FILEPATH_PREFIX}-src.zip"
@@ -263,7 +265,6 @@ jobs:
       - name: Upload to Subversion
         shell: bash
         env:
-          PROJECT_ID: ${{ inputs.project-id }}
           SVN_USERNAME: ${{ secrets.SVN_USERNAME }}
           SVN_PASSWORD: ${{ secrets.SVN_PASSWORD }}
         run: |
diff --git a/.github/workflows/deploy-site.yaml b/.github/workflows/deploy-site.yaml
index bd4171b..585c658 100644
--- a/.github/workflows/deploy-site.yaml
+++ b/.github/workflows/deploy-site.yaml
@@ -73,8 +73,10 @@ jobs:
     steps:
       - name: Export version
         id: export-version
+        env:
+          REF_NAME: ${{ github.ref_name }}
         run: |
-          version=$(echo "${{ github.ref_name }}" | sed 's/^release\///')
+          version=$(echo "$REF_NAME" | sed 's/^release\///' | tr -d '\r\n')
           echo "version=$version" >> "$GITHUB_OUTPUT"
 
   deploy-site-rel:
diff --git a/.github/workflows/verify-reproducibility-reusable.yaml b/.github/workflows/verify-reproducibility-reusable.yaml
index 54544a1..1a64ecb 100644
--- a/.github/workflows/verify-reproducibility-reusable.yaml
+++ b/.github/workflows/verify-reproducibility-reusable.yaml
@@ -37,6 +37,7 @@ on:
 
 env:
   MAVEN_ARGS: ${{ inputs.maven-args }}
+  NEXUS_URL: ${{ inputs.nexus-url }}
 
 jobs:
 
@@ -70,7 +71,7 @@ jobs:
           ./mvnw \
             --show-version --batch-mode --errors --no-transfer-progress \
             -DskipTests=true \
-            -Dreference.repo=${{ inputs.nexus-url }} \
+            -Dreference.repo="${NEXUS_URL}" \
             clean verify artifact:compare
 
       # Upload reproducibility results if the build fails.