Fix shell injection vulnerability in GitHub Actions workflow - #225
Fix shell injection vulnerability in GitHub Actions workflow#225fix-it-felix-sentry[bot] wants to merge 1 commit into
Conversation
Resolve code injection risk by using environment variables instead of direct interpolation of github.ref_name and github.sha in run steps. This prevents potential attackers from injecting malicious code through untrusted GitHub context data. Fixes: https://linear.app/getsentry/issue/VULN-1615 Fixes: https://linear.app/getsentry/issue/ENG-7577 Co-Authored-By: Claude Sonnet 4.5 <noreply@anthropic.com>
![cursor[bot]](https://avatars.githubusercontent.com/in/1210556?s=60&v=4){kind=small}
There was a problem hiding this comment.
Cursor Bugbot has reviewed your changes and found 1 potential issue.
❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, enable autofix in the Cursor dashboard.
Reviewed by Cursor Bugbot for commit b21b06a. Configure here.
| - name: Tag release version | ||
| env: | ||
| REF_NAME: ${{ github.ref_name }} | ||
| GITHUB_SHA: ${{ github.sha }} |
There was a problem hiding this comment.
Reserved GITHUB_SHA variable cannot be overridden in env
Low Severity
GITHUB_SHA is a reserved default environment variable in GitHub Actions, and GitHub's docs state that GITHUB_* variables cannot be overwritten. The env: GITHUB_SHA declaration may be silently ignored, with $GITHUB_SHA in the run block resolving to the built-in default instead. This happens to have the same value for release events, so no breakage occurs today, but the override is misleading. A non-reserved name like COMMIT_SHA would be more reliable and accurate.
Additional Locations (1)
Reviewed by Cursor Bugbot for commit b21b06a. Configure here.
Summary
This PR fixes a high-severity shell injection vulnerability in the GitHub Actions workflow by moving GitHub context values to environment variables.
Changes
.github/workflows/release-ghcr-version-tag.ymlto use environment variables (REF_NAMEandGITHUB_SHA) instead of directly interpolatinggithub.ref_nameandgithub.shain run stepsSecurity Impact
The previous implementation directly interpolated untrusted GitHub context data in shell commands, which could allow attackers to inject malicious code. This fix prevents such attacks by using intermediate environment variables.
References