From 72bb46e9b58ba84e620b1a20d21400c03589a8f5 Mon Sep 17 00:00:00 2001 From: grabowski Date: Thu, 23 Jul 2026 17:33:50 +0700 Subject: [PATCH] Harden the container checkout: no template expansion inside run github.ref reaches the shell via env instead of ${{ }} interpolation - a crafted PR branch name could otherwise inject commands into the runner - and ref/sha formats are validated before git sees them. --- .gitea/workflows/ci.yml | 18 ++++++++++++++---- 1 file changed, 14 insertions(+), 4 deletions(-) diff --git a/.gitea/workflows/ci.yml b/.gitea/workflows/ci.yml index e89d7d7..f4b240d 100644 --- a/.gitea/workflows/ci.yml +++ b/.gitea/workflows/ci.yml @@ -94,13 +94,23 @@ jobs: - name: Distro Qt runtime libraries + git run: ${{ matrix.setup }} # Plain-git checkout: works in any container with git alone. - # (A private repo would need ${{ github.token }} on the URL.) + # (A private repo would need github.token on the URL.) Values + # arrive via env, not ${{ }} in the script: a template expansion + # inside `run:` would let a crafted PR branch name inject shell + # commands into the runner. - name: Checkout + env: + SERVER_URL: ${{ github.server_url }} + REPO: ${{ github.repository }} + REF: ${{ github.ref }} + SHA: ${{ github.sha }} run: | + case "$REF" in refs/heads/*|refs/tags/*|refs/pull/*) ;; *) echo "unexpected ref: $REF"; exit 1;; esac + case "$SHA" in *[!0-9a-f]*|"") echo "unexpected sha"; exit 1;; esac git init -q . - git remote add origin "${{ github.server_url }}/${{ github.repository }}.git" - git fetch -q --depth 50 origin "${{ github.ref }}" - git checkout -q "${{ github.sha }}" + git remote add origin "$SERVER_URL/$REPO.git" + git fetch -q --depth 50 origin "$REF" + git checkout -q "$SHA" - name: Install uv run: | curl -LsSf https://astral.sh/uv/install.sh | sh