From 7c450c56bb2d365e27f018658637d9c48e94b17b Mon Sep 17 00:00:00 2001 From: Claude Date: Mon, 27 Jul 2026 10:38:33 +0000 Subject: [PATCH] ci: prevent script injection via github.head_ref in gendoc-docs github.head_ref is the pull request's branch name and is controllable by the PR author. Expanding it directly into the `run:` script let a crafted branch name inject shell commands into the "Commit the regenerated catalog" step (OSSF Scorecard "Dangerous-Workflow", the only code-level code-scanning alert). Route it through an environment variable and reference it quoted, so the shell -- not the Actions template engine -- handles the branch name as data. Co-Authored-By: Claude Opus 4.8 Claude-Session: https://claude.ai/code/session_01Kwid3AAwhHZQzCEGSoYdPY --- .github/workflows/gendoc-docs.yml | 8 +++++++- 1 file changed, 7 insertions(+), 1 deletion(-) diff --git a/.github/workflows/gendoc-docs.yml b/.github/workflows/gendoc-docs.yml index a5adca0d..350bfa39 100644 --- a/.github/workflows/gendoc-docs.yml +++ b/.github/workflows/gendoc-docs.yml @@ -75,6 +75,12 @@ jobs: > doc/generated/gendoc/errors-diff.md - name: Commit the regenerated catalog to this branch + env: + # github.head_ref (the PR's branch name) is controllable by the PR author, so it must never + # be expanded into the run script directly: a crafted branch name would inject shell commands. + # Route it through the environment and reference it quoted below, so the shell -- not the + # Actions template engine -- handles it as data. + HEAD_REF: ${{ github.head_ref }} run: | set -euo pipefail git config user.name "github-actions[bot]" @@ -90,4 +96,4 @@ jobs: # Pushes made with the default GITHUB_TOKEN do not re-trigger workflows (GitHub's own loop # guard), so this never causes another 'pull_request: synchronize' event and another run of # this job. - git push origin HEAD:${{ github.head_ref }} + git push origin "HEAD:$HEAD_REF"