Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

ci(pr-title): Escape variables used in bash scripts #328

Merged
merged 1 commit into from
May 2, 2024

Conversation

aborgna-q
Copy link
Collaborator

@aborgna-q aborgna-q commented May 2, 2024

Don't insert github expressions directly in the bash script.

  • It breaks if there are [backticks] or [quotes] inside the variable.
  • It's a security issue, it allows arbitrary code injections from the PR description.

The solution is to put them into env variables first.

@aborgna-q aborgna-q requested a review from cqc-alec May 2, 2024 11:46
@aborgna-q
Copy link
Collaborator Author

Failing job due to the ` in my description :P
https://github.com/CQCL/tket2/actions/runs/8923278983/job/24507186630?pr=328

Copy link

codecov bot commented May 2, 2024

Codecov Report

All modified and coverable lines are covered by tests ✅

Project coverage is 84.69%. Comparing base (5d3b0c9) to head (443b852).

Additional details and impacted files
@@           Coverage Diff           @@
##             main     #328   +/-   ##
=======================================
  Coverage   84.69%   84.69%           
=======================================
  Files          35       35           
  Lines        4442     4442           
  Branches     4290     4290           
=======================================
  Hits         3762     3762           
  Misses        501      501           
  Partials      179      179           

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

@aborgna-q aborgna-q enabled auto-merge May 2, 2024 11:53
@aborgna-q aborgna-q added this pull request to the merge queue May 2, 2024
Merged via the queue into main with commit df74fac May 2, 2024
12 of 13 checks passed
@aborgna-q aborgna-q deleted the ab/ci/escape-bash-vars branch May 2, 2024 11:55
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

2 participants