From 7999b843564118eadf82982664a1fbc40fd986d3 Mon Sep 17 00:00:00 2001 From: Devin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com> Date: Tue, 14 Jul 2026 15:22:06 +0000 Subject: [PATCH] Harden release workflow against script injection via release_version Pass the workflow_dispatch input through an env var instead of interpolating it into the run block, and validate it against a strict semver regex before use. Refs java-helpers/simple-builders#154 Co-Authored-By: Andreas Igel --- .github/workflows/maven-central-release.yml | 16 ++++++++++++++-- 1 file changed, 14 insertions(+), 2 deletions(-) diff --git a/.github/workflows/maven-central-release.yml b/.github/workflows/maven-central-release.yml index 83285e49..84eeb982 100644 --- a/.github/workflows/maven-central-release.yml +++ b/.github/workflows/maven-central-release.yml @@ -40,9 +40,21 @@ jobs: - name: Determine version id: version + env: + RELEASE_VERSION: ${{ github.event.inputs.release_version }} run: | - VERSION="${{ github.event.inputs.release_version }}" - echo "VERSION=$VERSION" >> $GITHUB_OUTPUT + # Do NOT interpolate the workflow input directly into the shell; + # read the untrusted input from an environment variable instead to + # avoid script injection. + VERSION="$RELEASE_VERSION" + + # Validate against a strict semver pattern before using it anywhere. + if ! [[ "$VERSION" =~ ^[0-9]+\.[0-9]+\.[0-9]+(-[0-9A-Za-z.-]+)?(\+[0-9A-Za-z.-]+)?$ ]]; then + echo "::error::Invalid release version '$VERSION'. Expected semver, e.g. 0.2.0 or 0.2.0-beta.1" + exit 1 + fi + + echo "VERSION=$VERSION" >> "$GITHUB_OUTPUT" echo "Releasing version: $VERSION" - name: Update POM versions