Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

fix(ci): moves vars to step env #2550

Merged
merged 1 commit into from
Jul 10, 2024
Merged

fix(ci): moves vars to step env #2550

merged 1 commit into from
Jul 10, 2024

Conversation

jurajpiar
Copy link
Member

Security Bugfix

Moves untrusted input of github variables to the step env var definition to prevent RCE. https://securitylab.github.com/research/github-actions-untrusted-input/

@jurajpiar jurajpiar requested review from a team July 5, 2024 09:05
bcodesido
bcodesido previously approved these changes Jul 5, 2024
Copy link
Member

@bcodesido bcodesido left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM

lucasvuotto
lucasvuotto previously approved these changes Jul 5, 2024
fmacleal
fmacleal previously approved these changes Jul 8, 2024
rmoreliovlabs
rmoreliovlabs previously approved these changes Jul 8, 2024
@bcodesido bcodesido dismissed stale reviews from rmoreliovlabs, fmacleal, lucasvuotto, and themself via 82d7104 July 8, 2024 18:50
@Vovchyk Vovchyk force-pushed the juraj/ci_rca_fix branch from 82d7104 to be01dd3 Compare July 10, 2024 07:25
Copy link

Copy link
Member

@bcodesido bcodesido left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM

@Vovchyk Vovchyk merged commit 63a59e5 into master Jul 10, 2024
17 checks passed
@Vovchyk Vovchyk deleted the juraj/ci_rca_fix branch July 10, 2024 12:06
@aeidelman aeidelman added this to the Arrowhead 6.4.0 milestone Oct 30, 2024
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

7 participants