Skip to content

fix(security): eliminate script injection vulnerabilities in action.yml#85

Merged
aknysh merged 5 commits intomainfrom
copilot/fix-security-weaknesses-github-actions
Mar 14, 2026
Merged

fix(security): eliminate script injection vulnerabilities in action.yml#85
aknysh merged 5 commits intomainfrom
copilot/fix-security-weaknesses-github-actions

Conversation

Copy link
Contributor

Copilot AI commented Mar 10, 2026

  • Identify security vulnerabilities in action.yml
  • Fix script injection via unquoted ${{ inputs.atmos-config-path }} in realpath call — use ATMOS_CONFIG_PATH env var and quote it
  • Fix script injection via unquoted ${{ inputs.base-ref }} in git checkout call — use BASE_REF/SKIP_CHECKOUT env vars and bash array
  • Fix script injection via direct ${{ inputs.* }} embedding in shell — all inputs now passed as env vars
  • Replace eval with bash arrays for safe atmos command execution — eliminated eval entirely
  • Remove the now-unnecessary affected-args intermediate step
  • DRY up repeated args-building logic: extract common args into a dedicated step writing to ${RUNNER_TEMP}/atmos-affected-args; both execution steps read it with mapfile

🔒 GitHub Advanced Security automatically protects Copilot coding agent pull requests. You can protect all pull requests by enabling Advanced Security for your repositories. Learn more about Advanced Security.

- Pass `inputs.atmos-config-path` through env var and quote it in
  `realpath` call to prevent command injection
- Pass `inputs.base-ref` and `inputs.skip-checkout` through env vars
  and use a bash array in the `git checkout` call to prevent injection
- Remove the `affected-args` intermediate step that built a raw shell
  string from unquoted `${{ inputs.* }}` expressions
- Replace `eval` in both `atmos describe affected` invocations with
  bash arrays built from env vars, eliminating arbitrary code execution
  via user-controlled inputs (`atmos-stack`, `identity`, etc.)

Co-authored-by: nitrocode <7775707+nitrocode@users.noreply.github.com>
Copilot AI changed the title [WIP] Fix security weaknesses in GitHub Actions and Go code fix(security): eliminate script injection vulnerabilities in action.yml Mar 10, 2026
@nitrocode nitrocode marked this pull request as ready for review March 10, 2026 17:24
…ted steps

Extract shared argument construction into a dedicated 'Build atmos
affected command args' step that writes args (one per line) to
${RUNNER_TEMP}/atmos-affected-args. Both 'affected-pro' and 'affected'
steps then read them back with mapfile, passing only the step-specific
flag (--upload or --file=) inline. No eval, no injection surface.

Co-authored-by: nitrocode <7775707+nitrocode@users.noreply.github.com>
@aknysh aknysh merged commit 4540695 into main Mar 14, 2026
22 checks passed
@aknysh aknysh deleted the copilot/fix-security-weaknesses-github-actions branch March 14, 2026 01:48
@github-actions
Copy link

These changes were released in v6.10.0.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

3 participants