Skip to content

sanitize github workflow variables #117

@litlfred

Description

@litlfred

in publication-request.yaml there are commands such as:
echo "Sequence: $SEQUENCE"

if $SEQUENCE contains a quote it's allowed to break out of the string.
Imagine $SEQUNCE was file";touch "pwned.yml (yes, that is a valid
file name), the code would become
echo "Hello, the path to this workflow is file";touch "pwned.yml"

please review all the github workflows and make sure variables are properly escaped/sanitized

Metadata

Metadata

Assignees

Labels

No labels
No labels

Type

No type

Projects

No projects

Milestone

No milestone

Relationships

None yet

Development

No branches or pull requests

Issue actions