Skip to content

[plan] Fix template injection in single-instance workflows #5754

Description

@github-actions

Objective

Fix template injection vulnerabilities in the four workflows with single instances of the vulnerability by replacing envsubst with safe in-place string substitution.

Context

These workflows each have one instance of the template injection vulnerability where envsubst processes potentially untrusted data.

Affected Workflows

  1. .github/workflows/breaking-change-checker.md - 1 instance
  2. .github/workflows/changeset.md - 1 instance
  3. .github/workflows/duplicate-code-detector.md - 1 instance

Required Changes

For each workflow, apply the same pattern:

Before (Vulnerable):

env:
  GH_AW_NEEDS_*_OUTPUTS_*: ${{ needs.*.outputs.* }}
run: |
  cat << 'PROMPT_EOF' | envsubst > "$GH_AW_PROMPT"
  [content with $GH_AW_NEEDS_*_OUTPUTS_*]
  PROMPT_EOF

After (Fixed):

env:
  GH_AW_NEEDS_*_OUTPUTS_*: ${{ needs.*.outputs.* }}
run: |
  # Write template directly to target file with placeholder
  cat << 'PROMPT_EOF' > "$GH_AW_PROMPT"
  [content with __GH_AW_NEEDS_*_OUTPUTS_*__]
  PROMPT_EOF
  
  # Safely substitute using sed
  sed -i "s|__GH_AW_NEEDS_*_OUTPUTS_*__|${GH_AW_NEEDS_*_OUTPUTS_*//|/\\|}|g" "$GH_AW_PROMPT"

Implementation Steps

  1. For each workflow file, identify the envsubst usage
  2. Replace $VAR references with __VAR__ placeholders in templates
  3. Replace envsubst command with sed-based substitution
  4. Verify no .template files are created
  5. Recompile all modified workflows: make recompile

Files to Modify

  • .github/workflows/breaking-change-checker.md
  • .github/workflows/changeset.md
  • .github/workflows/duplicate-code-detector.md

Acceptance Criteria

AI generated by Plan Command for discussion #5735

Activity

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Metadata

Metadata

Type

No type

Projects

No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions