You are viewing a plain text version of this content. The canonical link for it is here.
Posted to commits@camel.apache.org by "jamesnetherton (via GitHub)" <gi...@apache.org> on 2025/10/15 08:59:11 UTC
[PR] Sanitize storing of user-supplied github context data in pre-build-checks step [camel-quarkus]
jamesnetherton opened a new pull request, #7838:
URL: https://github.com/apache/camel-quarkus/pull/7838
(no comment)
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@camel.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] Sanitize storing of user-supplied github context data in pre-build-checks step [camel-quarkus]
Posted by "jamesnetherton (via GitHub)" <gi...@apache.org>.
jamesnetherton commented on code in PR #7838:
URL: https://github.com/apache/camel-quarkus/pull/7838#discussion_r2432273109
##########
.github/workflows/ci-build.yaml:
##########
@@ -128,8 +128,8 @@ jobs:
echo "continue-build=true" >> $GITHUB_OUTPUT
else
mkdir ./dependabot-pr
- echo ${{ github.head_ref }} > ./dependabot-pr/BRANCH_REF
- echo ${{ github.event.pull_request.head.sha }} > ./dependabot-pr/PR_HEAD_SHA
+ printf '%s\n' "${{ github.head_ref }}" > ./dependabot-pr/BRANCH_REF
+ printf '%s\n' "${{ github.event.pull_request.head.sha }}" > ./dependabot-pr/PR_HEAD_SHA
Review Comment:
I thought maybe to guard against being able to sneak in `\` sequences that could potentially alter the output. But now that I think about it more. I don't think `head_ref` or `sha` are vulnerable to such things.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@camel.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] Sanitize storing of user-supplied github context data in pre-build-checks step [camel-quarkus]
Posted by "ppalaga (via GitHub)" <gi...@apache.org>.
ppalaga commented on code in PR #7838:
URL: https://github.com/apache/camel-quarkus/pull/7838#discussion_r2431830748
##########
.github/workflows/ci-build.yaml:
##########
@@ -128,8 +128,8 @@ jobs:
echo "continue-build=true" >> $GITHUB_OUTPUT
else
mkdir ./dependabot-pr
- echo ${{ github.head_ref }} > ./dependabot-pr/BRANCH_REF
- echo ${{ github.event.pull_request.head.sha }} > ./dependabot-pr/PR_HEAD_SHA
+ printf '%s\n' "${{ github.head_ref }}" > ./dependabot-pr/BRANCH_REF
+ printf '%s\n' "${{ github.event.pull_request.head.sha }}" > ./dependabot-pr/PR_HEAD_SHA
Review Comment:
Is this supposed to be a protection against some sort of an attack? Why is printf more safe than echo?
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@camel.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] Sanitize storing of user-supplied github context data in pre-build-checks step [camel-quarkus]
Posted by "jamesnetherton (via GitHub)" <gi...@apache.org>.
jamesnetherton closed pull request #7838: Sanitize storing of user-supplied github context data in pre-build-checks step
URL: https://github.com/apache/camel-quarkus/pull/7838
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@camel.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org