Skip to content

[code-scanning-fix] Fix ai-scan/cwe-78: extract Actions expressions from shell comments in run steps #74855

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Closed
github-actions wants to merge 1 commit into from
Closed

[code-scanning-fix] Fix ai-scan/cwe-78: extract Actions expressions from shell comments in run steps #74855

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
18 changes: 11 additions & 7 deletions pkg/workflow/run_step_sanitizer.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -94,7 +94,11 @@ func sanitizeRunStepExpressions(step map[string]any) (map[string]any, []string,
return step, nil, false
}

scanContent := executableShellContent(runVal)
// Actions expands ${{ }} before the shell runs, so comments offer no
// protection: a value containing a newline escapes the comment. Only
// quoted heredoc bodies are left in place (rewriting them would emit the
// literal variable name); validation is responsible for those.
scanContent := transformShellContent(runVal, func(s string) string { return s }, true, false)
if !hasExpressionMarker(scanContent) {
return step, nil, false
}
Expand Down Expand Up @@ -231,7 +235,11 @@ func sanitizeRunStepExpressions(step map[string]any) (map[string]any, []string,
func replaceSanitizedRunStepExpression(run string, expression sanitizedExpression, shellValue any) string {
shell, shellIsString := shellValue.(string)
powershell := shellIsString && (strings.EqualFold(shell, "pwsh") || strings.EqualFold(shell, "powershell"))
updated, err := TransformExecutableShellContent(run, func(segment string) string {
regions, parsed := shellHeredocRegions(run, false)
if !parsed {
return run
}
return transformShellRegions(run, regions, func(segment string) string {
var result strings.Builder
for {
before, after, found := strings.Cut(segment, expression.Original)
Expand All @@ -250,11 +258,7 @@ func replaceSanitizedRunStepExpression(run string, expression sanitizedExpressio
segment = after
}
return result.String()
})
if err != nil {
return run
}
return updated
}, false)
}

// sanitizeCustomStepsYAML parses a raw "steps: ..." YAML string (as produced by
Expand Down
Loading