Context
Security review (same interpolation anti-pattern class as the release-tag injection); fixed in PR #28.
Problem
git config user.name '${{ github.actor }}' interpolated github.actor into run: bodies in three places. Not
exploitable today (GitHub usernames are restricted to alphanumerics and non-consecutive hyphens), but the same
interpolation anti-pattern the rest of this work removes.
Affected locations
| File |
actions/mkdocs-deploy/action.yml |
actions/release/github/action.yml |
.github/workflows/deploy-docs.yml |
Fix (PR #28)
env: GIT_ACTOR: ${{ github.actor }} + reference "$GIT_ACTOR".
Severity / Effort
Low · XS
Definition of Done
Context
Security review (same interpolation anti-pattern class as the release-tag injection); fixed in PR #28.
Problem
git config user.name '${{ github.actor }}'interpolatedgithub.actorintorun:bodies in three places. Notexploitable today (GitHub usernames are restricted to alphanumerics and non-consecutive hyphens), but the same
interpolation anti-pattern the rest of this work removes.
Affected locations
actions/mkdocs-deploy/action.ymlactions/release/github/action.yml.github/workflows/deploy-docs.ymlFix (PR #28)
env: GIT_ACTOR: ${{ github.actor }}+ reference"$GIT_ACTOR".Severity / Effort
Low · XS
Definition of Done
github.actorreferenced only viaenv:in the git-config steps