-
Notifications
You must be signed in to change notification settings - Fork 0
Support Thirdparty runner input toggle #140
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Conversation
| BUILD_REPO=${{ github.event.repository.name }} | ||
| BUILD_ID=${{ github.run_id }} | ||
| tags: ${{ steps.meta.outputs.tags }} | ||
| labels: ${{ steps.meta.outputs.labels }} |
Check warning
Code scanning / CodeQL
Code injection Medium
${ inputs.context }
Show autofix suggestion
Hide autofix suggestion
Copilot Autofix
AI 2 months ago
To fix this code injection issue, you should avoid passing direct ${{ inputs.context }} expression syntax to the context: field. Instead, assign the user-controlled input to an environment variable within the respective job/step, and then refer to that environment variable using shell or action syntax that avoids possible injection issues. For third-party actions such as docker/build-push-action, the context parameter must either be interpolated safely or referenced via a shell environment variable. The recommended solution is to set CONTEXT: ${{ inputs.context }} as an environment variable at the job level, then refer to it in context: $CONTEXT (shell variable syntax) or whatever syntax is supported by the third-party action for environment variable interpolation. If the action doesn't automatically substitute env vars in its parameters, add a preceding step using run: to safely create and export the context or otherwise sanitize it. This change must be applied to both blocks using docker/build-push-action and the analogous block for useblacksmith/build-push-action.
Required changes:
- Add an environment variable
CONTEXT: ${{ inputs.context }}in the job'senv:section. - Change the
context:field in both relevant with-blocks to use$CONTEXTinstead of${{ inputs.context }}.
-
Copy modified line R166 -
Copy modified line R279 -
Copy modified line R300
| @@ -163,6 +163,7 @@ | ||
| DEPLOY_USER_SSH_KEY: ${{ secrets.deploy_user_ssh_key }} | ||
| REPOSITORY: ${{ inputs.repository }} | ||
| REPO: ${{ inputs.repo }} | ||
| CONTEXT: ${{ inputs.context }} | ||
| outputs: | ||
| image: ${{ steps.meta.outputs.tags }} | ||
| steps: | ||
| @@ -275,7 +276,7 @@ | ||
| name: Build (and push) Docker image for thirparty runner | ||
| uses: useblacksmith/build-push-action@v2 | ||
| with: | ||
| context: ${{ inputs.context }} | ||
| context: $CONTEXT | ||
| push: ${{ inputs.push }} | ||
| file: ${{ inputs.dockerfile }} | ||
| secrets: ${{ secrets.build-secrets }} | ||
| @@ -296,7 +297,7 @@ | ||
| name: Build (and push) Docker image | ||
| uses: docker/build-push-action@v5 | ||
| with: | ||
| context: ${{ inputs.context }} | ||
| context: $CONTEXT | ||
| push: ${{ inputs.push }} | ||
| file: ${{ inputs.dockerfile }} | ||
| secrets: ${{ secrets.build-secrets }} |
No description provided.