Workflows: use env vars to prevent injections

bblanchon · bblanchon · commit d31afc2e24e1 · 2025-09-05T18:21:18.000+02:00
diff --git a/.github/workflows/build-all.yml b/.github/workflows/build-all.yml
@@ -603,12 +603,16 @@ jobs:
       - name: Define properties
         shell: bash
         run: |
-          VERSION="${{ github.event.inputs.version || '0.0.0.0' }}"
+          VERSION="$VERSION"
           BRANCH="${GITHUB_REF#refs/heads/}"
           COMMIT="${GITHUB_SHA}"
           RELEASE_NOTES="${{github.server_url}}/${{github.repository}}/releases"
-          ${{ github.event.inputs.release }} && RELEASE_NOTES+="/tag/${{ github.event.inputs.branch }}"
+          ${{ RELEASE }} && RELEASE_NOTES+="/tag/$BRANCH"
           echo "NUSPEC_PROPERTIES=version=$VERSION;branch=$BRANCH;commit=$COMMIT;releaseNotes=$RELEASE_NOTES" >> "$GITHUB_ENV"
+        env:
+          VERSION: ${{ github.event.inputs.version || '0.0.0.0' }}
+          RELEASE: ${{ github.event.inputs.release }}
+          BRANCH: ${{ github.event.inputs.branch }}
       - name: Pack
         shell: bash
         run: |
@@ -651,7 +655,7 @@ jobs:
 
           PLATFORM=\$1
           SOURCE_DIR=\$2
-          VERSION="${{ github.event.inputs.version }}"
+          VERSION="$VERSION"
 
           # rename "include/" into "include/pdfium/"
           shopt -s extglob
@@ -661,6 +665,8 @@ jobs:
           python conda/build.py pdfium-binaries \$PLATFORM \$VERSION --about-file conda/about.json --source-dir \$SOURCE_DIR --output-dir conda/out
           END
           chmod +x conda-build.sh
+        env:
+          VERSION: ${{ github.event.inputs.version }}
       - name: Build for linux-64
         run: ./conda-build.sh linux-64 pdfium-linux-x64
       - name: Build for linux-aarch64
@@ -745,18 +751,22 @@ jobs:
             echo "::endgroup::"
           done
       - name: Write release body
-        run: echo 'This version was built with branch `${{ github.event.inputs.branch }}` of PDFium' > RELEASE.md
+        run: echo 'This version was built with branch `$BRANCH` of PDFium' > RELEASE.md
+        env:
+          BRANCH: ${{ github.event.inputs.branch }}
       - name: Get changes
         continue-on-error: true
         run: |
-          CURRENT_REV=${{ github.event.inputs.branch }}
+          CURRENT_REV=$BRANCH
           PREVIOUS_REV=$(curl --silent "https://api.github.com/repos/${{ github.repository }}/releases/latest" | jq -r ".tag_name")
-          git clone -b "${{ github.event.inputs.branch }}" https://pdfium.googlesource.com/pdfium.git
+          git clone -b "$BRANCH" https://pdfium.googlesource.com/pdfium.git
           cat <<END >> RELEASE.md
           ### Changes
           Commits between \`$PREVIOUS_REV\` and \`$CURRENT_REV\`:
           END
           git -C "pdfium" log origin/${PREVIOUS_REV}.. --pretty=format:'* [%s](https://pdfium.googlesource.com/pdfium/+/%H)' >> RELEASE.md
+        env:
+          BRANCH: ${{ github.event.inputs.branch }}
       - name: Generate artifacts checksums
         id: hash
         run: echo "hashes=$(sha256sum pdfium-*.tgz | base64 -w0)" >> "$GITHUB_OUTPUT"
diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml
@@ -51,34 +51,32 @@ jobs:
     outputs:
       artifact: ${{ steps.init.outputs.artifact }}
     runs-on: ${{ (inputs.target_os == 'ios' || inputs.target_os == 'mac') && 'macos-14' || inputs.target_os == 'win' && 'windows-2022' || 'ubuntu-24.04' }}
+    env:
+      PDFium_BRANCH: $BRANCH
+      PDFium_IS_DEBUG: ${{ inputs.is_debug }}
+      PDFium_TARGET_CPU: ${{ inputs.target_cpu }}
+      PDFium_TARGET_OS: ${{ inputs.target_os }}
+      PDFium_TARGET_ENVIRONMENT: ${{ inputs.target_environment }}
+      PDFium_ENABLE_V8: ${{ inputs.enable_v8 }}
+      PDFium_VERSION: ${{ inputs.version }}
+      EMSDK_VERSION: ${{ inputs.emsdk_version }}
+      MUSL_URL: ${{ secrets.MUSL_URL }}
     steps:
       - name: Initialize
         id: init
         shell: bash
         run: |
           ARTIFACT="pdfium"
-          [ "${{inputs.enable_v8}}" == "true" ] && ARTIFACT="$ARTIFACT-v8"
-          [ "${{inputs.target_os}}" != "emscripten" ] && ARTIFACT="$ARTIFACT-${{inputs.target_os}}"
-          [ "${{inputs.target_environment}}" != "" ] && ARTIFACT="$ARTIFACT-${{inputs.target_environment}}"
-          ARTIFACT="$ARTIFACT-${{inputs.target_cpu}}"
+          [ "$PDFium_ENABLE_V8" == "true" ] && ARTIFACT="$ARTIFACT-v8"
+          [ "$PDFium_TARGET_OS" != "emscripten" ] && ARTIFACT="$ARTIFACT-$PDFium_TARGET_OS"
+          [ "$PDFium_TARGET_ENVIRONMENT" != "" ] && ARTIFACT="$ARTIFACT-$PDFium_TARGET_ENVIRONMENT"
+          ARTIFACT="$ARTIFACT-$PDFium_TARGET_CPU"
           [ "${{inputs.is_debug}}" == "true" ] && ARTIFACT="$ARTIFACT-debug"
           echo "artifact=$ARTIFACT" >> $GITHUB_OUTPUT
       - name: Checkout this repo
         uses: actions/checkout@v4
       - name: Set environment variables
-        run: |
-          cat >>$GITHUB_ENV <<END
-          PDFium_BRANCH=${{ inputs.branch }}
-          PDFium_IS_DEBUG=${{ inputs.is_debug }}
-          PDFium_TARGET_CPU=${{ inputs.target_cpu }}
-          PDFium_TARGET_OS=${{ inputs.target_os }}
-          PDFium_TARGET_ENVIRONMENT=${{ inputs.target_environment }}
-          PDFium_ENABLE_V8=${{ inputs.enable_v8 }}
-          PDFium_VERSION=${{ inputs.version }}
-          EMSDK_VERSION=${{ inputs.emsdk_version }}
-          MUSL_URL=${{ secrets.MUSL_URL }}
-          END
-          steps/00-environment.sh
+        run: steps/00-environment.sh
         shell: bash
       - name: Install (1/2)
         run: steps/01-install.sh
diff --git a/.github/workflows/mac-univ.yml b/.github/workflows/mac-univ.yml
@@ -14,17 +14,19 @@ on:
         description: "The name of the artifact"
         value: ${{ jobs.build.outputs.artifact }}
 
-
 jobs:
   build:
     runs-on: macos-latest
     outputs:
       artifact: ${{ steps.init.outputs.artifact }}
+    env:
+      ARTIFACT_X64: ${{ inputs.artifact_x64 }}
+      ARTIFACT_ARM64: ${{ inputs.artifact_arm64 }}
     steps:
       - name: Initialize
         id: init
         run: |
-          echo "artifact=${{inputs.artifact_x64}}" | sed "s/x64/univ/g" >> $GITHUB_OUTPUT
+          echo "artifact=$ARTIFACT_X64" | sed "s/x64/univ/g" >> $GITHUB_OUTPUT
       - name: Download ${{ inputs.artifact_x64 }}
         uses: actions/download-artifact@v4
         with:
@@ -37,13 +39,16 @@ jobs:
           path: ${{ inputs.artifact_arm64 }}
       - name: Create universal library
         run: |
-          cp -r ${{ inputs.artifact_arm64 }} ${{ steps.init.outputs.artifact }}
-          sed -i '' '/target_cpu/d' ${{ steps.init.outputs.artifact }}/args.gn
-          rm ${{ steps.init.outputs.artifact }}/lib/libpdfium.dylib
+          cp -r $ARTIFACT_ARM64 $OUTPUT_DIR
+          sed -i '' '/target_cpu/d' $OUTPUT_DIR/args.gn
+          rm $OUTPUT_DIR/lib/libpdfium.dylib
           lipo -create \
-            ${{ inputs.artifact_arm64 }}/lib/libpdfium.dylib \
-            ${{ inputs.artifact_x64 }}/lib/libpdfium.dylib \
-            -output ${{ steps.init.outputs.artifact }}/lib/libpdfium.dylib
+            $ARTIFACT_ARM64/lib/libpdfium.dylib \
+            $ARTIFACT_X64/lib/libpdfium.dylib \
+            -output $OUTPUT_DIR/lib/libpdfium.dylib
+        env:
+          OUTPUT_DIR: ${{ steps.init.outputs.artifact }}
+
       - name: Upload artifact
         uses: actions/upload-artifact@v4
         with:
