mirror of
https://github.com/storytold/craft-common-actions.git
synced 2026-11-03 01:08:06 +00:00
Dylan M. Taylor
2446e3bd4f
* security(actions): stop evaluating tool-version inputs as shell/pwsh source
The install-wix, install-nfpm, install-trunk, and packaging-lint composite
actions interpolated their *-version (and deb-arch) inputs directly into
Bash/PowerShell source when constructing download URLs. A command substitution
or subexpression in those values executed on the runner before any checksum
verification (CWE-78).
install-trunk additionally placed the version into a URL path component, so
path-traversal segments could point both the archive and its fallback checksum
at an attacker-controlled repository (CWE-23).
Fixes:
- Pass every version/arch input through the step `env:` and read it with quoted
variable expansions instead of GitHub `${{ }}` interpolation in script bodies.
- Validate a strict version grammar (and an allow-list for deb-arch) before the
value is used, which also excludes slashes and other URL path-traversal
characters so the download publisher stays fixed.
No change to default versions, pinned checksums, or install behavior.
* security(actions): anchor version validation against the whole value
Address review feedback:
- The bash version checks used `printf %s | grep -Eq '^...$'`, which matches
line-by-line. A value like `2.49.0\ninvalid` passed and then flowed into the
download URL. Switch to a bash `[[ =~ ^...$ ]]` test, which anchors the entire
string and rejects any value containing a newline. Applied to install-nfpm,
install-trunk, and packaging-lint.
- The install-wix PowerShell check used `$`, which in .NET also matches before a
trailing newline. Use `\z` (absolute end of input) so a trailing-newline value
cannot bypass validation.