fix: prevent script injection via workflow_dispatch releaseTag input (CWE-78) - #393
Merged
britaniar merged 1 commit intoJul 30, 2026
Merged
Conversation
…(CWE-78)
The releaseTag workflow_dispatch input was interpolated unquoted
directly into a bash run: block via ${{ inputs.releaseTag }}, which
GitHub Actions substitutes textually before the shell parses the
script. A crafted input value could break out of the assignment and
execute arbitrary commands with the release job's Azure managed
identity permissions.
Pass the input through an env: mapping and reference it as a quoted
shell variable instead of interpolating the expression directly. Also
replace the deprecated ::set-output command with $GITHUB_OUTPUT.
Fixes Azure#391
Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
Codecov Report✅ All modified and coverable lines are covered by tests. Additional details and impacted files@@ Coverage Diff @@
## main #393 +/- ##
==========================================
+ Coverage 67.06% 67.11% +0.05%
==========================================
Files 33 33
Lines 3783 3783
==========================================
+ Hits 2537 2539 +2
+ Misses 1072 1070 -2
Partials 174 174 ☔ View full report in Codecov by Harness. 🚀 New features to boost your workflow:
|
weng271190436
approved these changes
Jul 30, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Fixes CWE-78 (OS Command Injection / GitHub Actions script injection): the
releaseTagworkflow_dispatchinput was interpolated unquoted directly into a bashrun:block via${{ inputs.releaseTag }}. GitHub Actions substitutes${{ }}expressions textually into the script before the shell parses it, so a craftedreleaseTagvalue (e.g.x"; curl ... | bash; #) could break out of the assignment and run arbitrary commands with the release job's Azure managed identity permissions (used later toaz login --identityand push images to ACR/MCR).Change
inputs.releaseTagthrough anenv:mapping (RELEASE_TAG_INPUT) instead of interpolating it directly into the script body.RELEASE_TAG="$RELEASE_TAG_INPUT".::set-outputcommand with$GITHUB_OUTPUTas a drive-by cleanup since the line was already being touched.Fixes
Fixes #391