Skip to content

Commit 5732b69

Browse files
authored
Update documentation example usage to avoid executing untrusted inputs (#336)
The example shown in the documentation: https://github.com/Codex-/return-dispatch/blob/16fa9d14771c4d56ae0196bbda1d3c17f7f3650f/README.md?plain=1#L67-L68 Is vulnerable to untrusted input execution (i.e. `distinct_id` _could_ be a malicious command). See [this document](https://securitylab.github.com/resources/github-actions-untrusted-input/) (specifically - `Remediation`) for more details. Also, the command can be simplified [as `inputs.blah` is equivalent to `github.event.inputs.blah`](https://docs.github.com/en/actions/reference/workflows-and-actions/events-that-trigger-workflows#providing-inputs), but [_also_ handles `workflow_call` `inputs`](https://github.blog/changelog/2022-06-09-github-actions-inputs-unified-across-manual-and-reusable-workflows/).
1 parent 16fa9d1 commit 5732b69

1 file changed

Lines changed: 4 additions & 2 deletions

File tree

README.md

Lines changed: 4 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -64,8 +64,10 @@ jobs:
6464
test:
6565
runs-on: ubuntu-latest
6666
steps:
67-
- name: echo distinct ID ${{ github.event.inputs.distinct_id }}
68-
run: echo ${{ github.event.inputs.distinct_id }}
67+
- name: echo distinct ID ${{ inputs.distinct_id }}
68+
run: echo "${DISTINCT_ID}"
69+
env:
70+
DISTINCT_ID: ${{ inputs.distinct_id }}
6971
```
7072

7173
## Token

0 commit comments

Comments
 (0)