feat: filter .github files

sanity-io · Dec 13, 2024 · f011275 · f011275
1 parent 27fa7e5
commit f011275
Showing 1 changed file with 5 additions and 0 deletions.
diff --git a/packages/@sanity/cli/src/util/remoteTemplate.ts b/packages/@sanity/cli/src/util/remoteTemplate.ts
@@ -181,6 +181,11 @@ export async function downloadAndExtractRepo(
           const pathSegments = posixPath.split(posix.sep)
           rootPath = pathSegments.length ? pathSegments[0] : null
         }
+        // Exclude files in the .github directory to prevent potential security risks
+        // from running unknown actions if the repository is pushed to GitHub
+        if (posixPath.includes('/.github/')) {
+          return false
+        }
         return posixPath.startsWith(`${rootPath}${filePath ? `/${filePath}/` : '/'}`)
       },
     }),