From 262d112311797c864edbba67021d3c6188f8b302 Mon Sep 17 00:00:00 2001 From: Derrick Williams Date: Fri, 12 Jun 2026 08:24:29 -0400 Subject: [PATCH 1/2] Potential fix for Environment variable built from user-controlled sources Co-authored-by: Copilot Autofix powered by AI <62310815+github-advanced-security[bot]@users.noreply.github.com> --- .../beam_Publish_Beam_SDK_Snapshots.yml | 17 +++++++++++++++-- 1 file changed, 15 insertions(+), 2 deletions(-) diff --git a/.github/workflows/beam_Publish_Beam_SDK_Snapshots.yml b/.github/workflows/beam_Publish_Beam_SDK_Snapshots.yml index 526abfd4e30b..c891694bc0f5 100644 --- a/.github/workflows/beam_Publish_Beam_SDK_Snapshots.yml +++ b/.github/workflows/beam_Publish_Beam_SDK_Snapshots.yml @@ -88,8 +88,21 @@ jobs: # This is needed to run pipelines that use the default environment at HEAD, for example, when a # pipeline uses an expansion service built from HEAD. run: | - BEAM_VERSION_LINE=$(cat gradle.properties | grep "sdk_version") - echo "BEAM_VERSION=${BEAM_VERSION_LINE#*sdk_version=}" >> $GITHUB_ENV + BEAM_VERSION_LINE=$(grep -m1 '^sdk_version=' gradle.properties || true) + if [ -z "$BEAM_VERSION_LINE" ]; then + echo "Could not find sdk_version in gradle.properties" + exit 1 + fi + + BEAM_VERSION="${BEAM_VERSION_LINE#sdk_version=}" + + # Prevent environment file injection via CR/LF. + if printf '%s' "$BEAM_VERSION" | grep -q $'[\r\n]'; then + echo "Invalid sdk_version: contains newline characters" + exit 1 + fi + + printf 'BEAM_VERSION=%s\n' "$BEAM_VERSION" >> "$GITHUB_ENV" - name: Set latest tag only on master branch if: github.ref == 'refs/heads/master' run: echo "LATEST_TAG=,latest" >> $GITHUB_ENV From d3f9522066042792720c28e0e4dc9b8802fa8ceb Mon Sep 17 00:00:00 2001 From: Derrick Williams Date: Mon, 3 Aug 2026 14:07:36 +0000 Subject: [PATCH 2/2] update return/new line guard --- .github/workflows/beam_Publish_Beam_SDK_Snapshots.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.github/workflows/beam_Publish_Beam_SDK_Snapshots.yml b/.github/workflows/beam_Publish_Beam_SDK_Snapshots.yml index c891694bc0f5..5e2cb66b4fdf 100644 --- a/.github/workflows/beam_Publish_Beam_SDK_Snapshots.yml +++ b/.github/workflows/beam_Publish_Beam_SDK_Snapshots.yml @@ -97,7 +97,7 @@ jobs: BEAM_VERSION="${BEAM_VERSION_LINE#sdk_version=}" # Prevent environment file injection via CR/LF. - if printf '%s' "$BEAM_VERSION" | grep -q $'[\r\n]'; then + if [[ "$BEAM_VERSION" =~ [$'\r\n'] ]]; then echo "Invalid sdk_version: contains newline characters" exit 1 fi