Skip to content

fix: avoid using comment body directly #8851

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
merged 6 commits into from
Aug 2, 2023
Merged

fix: avoid using comment body directly #8851

Changes from 1 commit
Commits
Show all changes
6 commits
Select commit Hold shift + click to select a range
1a5606e
fix: do not use commnet_body directly
matifali Aug 2, 2023
26a28a0
Merge remote-tracking branch 'origin/main' into matifali/fix-pr-code-…
matifali Aug 2, 2023
43ccef2
Merge branch 'main' into matifali/fix-pr-code-injection
matifali Aug 2, 2023
4b71788
use env
matifali Aug 2, 2023
1ac48d9
fmt
matifali Aug 2, 2023
1d9683d
fmt
matifali Aug 2, 2023
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
Next Next commit
fix: do not use commnet_body directly 
This will fix https://github.com/coder/coder/security/code-scanning/195
  • Loading branch information
@matifali
matifali authored Aug 2, 2023
commit 1a5606e0d5642e09baa94429d643c20269c3e800
11 changes: 10 additions & 1 deletion .github/workflows/pr-deploy.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -234,7 +234,16 @@ jobs:
if [[ ${{ github.event_name }} == "workflow_dispatch" ]]; then
experiments=${{ github.event.inputs.experiments }}
else
experiments=$(echo "${{ github.event.comment.body }}" | grep -oP '(?<=--experiments )[^ ]+')
comment_body=${{ github.event.comment.body }}
# extract experiments part
extracted_experiments=$(echo "$comment_body" | grep -oP '(?<=--experiments )[^ ]+')
# Validate that the experiments is a comma-separated list of alphanumeric strings, "*", or "-"
if [[ $extracted_experiments =~ ^[a-zA-Z0-9_*,\"-]+$ ]]; then
experiments=$extracted_experiments
else
echo "Invalid input: $extracted_experiments"
exit 1
fi
fi
echo "experiments=$experiments" >> $GITHUB_OUTPUT

Expand Down