actions/toolkit
1
0
Fork 0
mirror of https://git.mirrors.martin98.com/https://github.com/actions/toolkit synced 2026-03-20 13:22:35 +08:00
Code Issues Packages Projects Releases Wiki Activity

Merge pull request from GHSA-7r3h-m5j6-3q42

Browse Source 
* use uuid as our multiline env delimiter

* remove extra fn

* Fix version

* also throw error if delimiter is found in name or value

* move delimiter and uuid to global var in test

* upgrade uuid to newest version

* remove spy variable

* Update packages/core/src/core.ts

Co-authored-by: Thomas Boop <52323235+thboop@users.noreply.github.com>

* Update packages/core/src/core.ts

Co-authored-by: Thomas Boop <52323235+thboop@users.noreply.github.com>
This commit is contained in:
Cory Miller
2022-08-08 14:16:39 -04:00
committed by GitHub
parent 90be12a59c
commit 4beda9cbc0
5 changed files with 92 additions and 11 deletions
Download Patch File Download Diff File Expand all files Collapse all files

13
packages/core/src/core.ts
View File

@@ -4,6 +4,7 @@ import {toCommandProperties, toCommandValue} from './utils'
import * as os from 'os'
import * as path from 'path'
import { v4 as uuidv4 } from 'uuid'
import {OidcClient} from './oidc-utils'
@@ -86,7 +87,17 @@ export function exportVariable(name: string, val: any): void {
const filePath = process.env['GITHUB_ENV'] || ''
if (filePath) {
const delimiter = '_GitHubActionsFileCommandDelimeter_'
const delimiter = `ghadelimiter_${uuidv4()}`
// These should realistically never happen, but just in case someone finds a way to exploit uuid generation let's not allow keys or values that contain the delimiter.
if (name.includes(delimiter)) {
throw new Error(`Unexpected input: name should not contain the delimiter "${delimiter}"`)
}
if (convertedVal.includes(delimiter)) {
throw new Error(`Unexpected input: value should not contain the delimiter "${delimiter}"`)
}
const commandValue = `${name}<<${delimiter}${os.EOL}${convertedVal}${os.EOL}${delimiter}`
issueFileCommand('ENV', commandValue)
} else {