Skip to content

Sanitize branch ref handling in test workflow shell steps#5

Open
theinfosecguy wants to merge 1 commit intolinkedin:masterfrom
theinfosecguy:theinfosecguy/sanitize-test-branch-ref-shell
Open

Sanitize branch ref handling in test workflow shell steps#5
theinfosecguy wants to merge 1 commit intolinkedin:masterfrom
theinfosecguy:theinfosecguy/sanitize-test-branch-ref-shell

Conversation

@theinfosecguy
Copy link
Copy Markdown

@theinfosecguy theinfosecguy commented Mar 27, 2026

Summary

  • Move branch reference capture in test.yml into an explicit HEAD_REF environment variable.
  • Write the branch output using printf with quoting so branch names are handled as plain data.
  • Keep existing checkout metadata behavior while removing shell interpolation risk from direct expression expansion.

Testing Done

  • Reviewed generated shell script behavior for the updated step.
  • Verified change scope is limited to metadata output in test.yml.
  • CI run validation in upstream repository by maintainers.

Route the branch reference through an environment variable and print it with printf so branch names are treated as data instead of shell syntax.

Made-with: Cursor
@theinfosecguy theinfosecguy force-pushed the theinfosecguy/sanitize-test-branch-ref-shell branch from 8b09de5 to c273978 Compare March 27, 2026 08:07
Copy link
Copy Markdown
Member

@ChrisCarini ChrisCarini left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM! Consider contributing this upstream, too!

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants