actions/toolkit
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Restrict sanitization to only allow 0-9, a-z, _, -, .

Browse Source 
Co-authored-by: TingluoHuang <[email protected]>
This commit is contained in:
copilot-swe-agent[bot]
2026-01-06 17:37:28 +00:00
co-authored by TingluoHuang
parent af6de2cb95
commit 2215c8e5aa
1 changed files with 3 additions and 3 deletions
Download Patch File Download Diff File Expand all files Collapse all files
packages/http-client/src/index.ts
+3 -3
View File
@@ -821,9 +821,9 @@ export class HttpClient {
private _getUserAgentWithOrchestrationId(userAgent: string): string { private _getUserAgentWithOrchestrationId(userAgent: string): string {
const orchId = process.env['ACTIONS_ORCHESTRATION_ID'] const orchId = process.env['ACTIONS_ORCHESTRATION_ID']
if (orchId) { if (orchId) {
// Sanitize the orchestration ID to ensure it contains only valid token characters // Sanitize the orchestration ID to ensure it contains only valid characters
// Valid characters: alphanumeric, !, #, $, %, &, ', *, +, -, ., ^, _, `, |, ~ // Valid characters: 0-9, a-z, _, -, .
const sanitizedId = orchId.replace(/[^a-zA-Z0-9!#$%&'*+.^_`|~-]/g, '_') const sanitizedId = orchId.replace(/[^a-z0-9_.\-]/gi, '_')
return `${userAgent} actions_orchestration_id/${sanitizedId}` return `${userAgent} actions_orchestration_id/${sanitizedId}`
} }
return userAgent return userAgent