chenlin/Mujoco_WASM
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Place untrusted data from the git commit metadata in environment variables.

Browse Source 
This prevents bash from executing strings in the commit metadata as code when reporting build errors.

PiperOrigin-RevId: 580155315
Change-Id: I4046eabd76eba14297fffe4e2fced59259d80f21
This commit is contained in:
Saran Tunyasuvunakool
2023-11-07 06:13:13 -08:00
committed by Copybara-Service
parent 1881c2d881
commit 7207b60b5a
1 changed files with 29 additions and 17 deletions
Download Patch File Download Diff File Expand all files Collapse all files
.github/workflows/build.yml
+29 -17
View File
@@ -252,20 +252,32 @@ jobs:
- name: Notify team chat - name: Notify team chat
shell: bash shell: bash
env: env:
GCHAT_API: ${{ secrets.GCHAT_API }} GCHAT_API_URL: ${{ secrets.GCHAT_API }}
JOB_URL: "${{ github.server_url }}/${{ github.repository }}/actions/runs/\ JOB_URL: "${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_id }}"
${{ github.run_id }}" CHATMSG_AUTHOR_NAME: ${{ github.event.head_commit.author.name }}
if: ${{ failure() && github.event_name == 'push' && env.GCHAT_API != '' }} CHATMSG_AUTHOR_EMAIL: ${{ github.event.head_commit.author.email }}
run: > CHATMSG_COMMIT_MESSAGE: ${{ github.event.head_commit.message }}
curl CHATMSG_JOB_ID: ${{ matrix.os }}${{ matrix.additional_label }}
"$GCHAT_API&threadKey=$GITHUB_SHA&messageReplyOption=REPLY_MESSAGE_FALLBACK_TO_NEW_THREAD" if: ${{ failure() && github.event_name == 'push' && env.GCHAT_API_URL != '' }}
-X POST run: |
-H "Content-Type: application/json" CHATMSG="$(cat <<-'EOF' | python3
-d "{ import json
'text': '<$JOB_URL|*FAILURE*>: import os
job \`${{ matrix.os }}${{ matrix.additional_label }}\` env = lambda x: os.getenv(x, '')
commit \`$(echo $GITHUB_SHA | head -c6)\`\n data = dict(
\`\`\`Author: ${{ github.event.head_commit.author.name }} result=env('JOB_URL'),
<${{ github.event.head_commit.author.email }}> job=env('CHATMSG_JOB_ID'),
\n\n${{ github.event.head_commit.message }}\`\`\` commit=env('GITHUB_SHA')[:6],
'}" name=env('CHATMSG_AUTHOR_NAME').replace('```', ''),
email=env('CHATMSG_AUTHOR_EMAIL'),
msg=env('CHATMSG_COMMIT_MESSAGE').replace('```', '')
)
text = '<{result}|*FAILURE*>: job `{job}` commit `{commit}`\n```Author: {name}<{email}>\n\n{msg}```'.format(**data)
print(json.dumps({'text' : text}))
EOF
)" &&
curl "$GCHAT_API_URL&threadKey=$GITHUB_SHA&messageReplyOption=REPLY_MESSAGE_FALLBACK_TO_NEW_THREAD" \
-X POST \
-H "Content-Type: application/json" \
--data-raw "${CHATMSG}"