Merge pull request #7 from actions/command-injection-bounty

Mitigate command injection vulnerability
2022-12-13 10:55:26 -08:00
parent f9e0aa0d46 630b7bbd94
commit a6eac1f5b7
1 changed files with 5 additions and 2 deletions
@@ -58,9 +58,12 @@ jobs:
        run: bundle install --without development
      - name: Prepare arguments
        id: prepare
+        env:
+          ISSUE_BODY: ${{ github.event.issue.body }}
+          COMMENT_BODY: ${{ github.event.comment.body }}
+          LABELS: ${{ toJSON(github.event.issue.labels.*.name) }}
        run: |
-          echo "${{ toJSON(github.event.issue.labels.*.name) }}"
-          ./bin/parse_issue "${{ github.event.issue.body }}" "${{ github.event.comment.body }}" "${{ toJSON(github.event.issue.labels.*.name) }}"
+          ./bin/parse_issue "${{ env.ISSUE_BODY }}" "${{ env.COMMENT_BODY }}" "${{ env.LABELS }}"
      - name: Validate arguments
        run: |
          if [ -z "${{ steps.prepare.outputs.provider }}" ]; then