Commit 5732b69
authored
Update documentation example usage to avoid executing untrusted inputs (#336)
The example shown in the documentation:
https://github.com/Codex-/return-dispatch/blob/16fa9d14771c4d56ae0196bbda1d3c17f7f3650f/README.md?plain=1#L67-L68
Is vulnerable to untrusted input execution (i.e. `distinct_id` _could_ be a malicious command). See [this document](https://securitylab.github.com/resources/github-actions-untrusted-input/) (specifically - `Remediation`) for more details.
Also, the command can be simplified [as `inputs.blah` is equivalent to `github.event.inputs.blah`](https://docs.github.com/en/actions/reference/workflows-and-actions/events-that-trigger-workflows#providing-inputs), but [_also_ handles `workflow_call` `inputs`](https://github.blog/changelog/2022-06-09-github-actions-inputs-unified-across-manual-and-reusable-workflows/).1 parent 16fa9d1 commit 5732b69
1 file changed
Lines changed: 4 additions & 2 deletions
| Original file line number | Diff line number | Diff line change | |
|---|---|---|---|
| |||
64 | 64 | | |
65 | 65 | | |
66 | 66 | | |
67 | | - | |
68 | | - | |
| 67 | + | |
| 68 | + | |
| 69 | + | |
| 70 | + | |
69 | 71 | | |
70 | 72 | | |
71 | 73 | | |
| |||
0 commit comments