Untrusted text run as code in a workflow (ARCH10031)

Key config.ci.github-script-injection · Severity error · Category security · CWE CWE-78

${{ ... }} is pasted into the script before the shell runs it. When the expression is text the author of an issue, pull request, comment, review or commit chooses (a title, a body, a branch name, a commit message), that author writes part of your script. run steps and actions/github-script scripts are read.

Incorrect

on:
  issues:
    types: [opened]
jobs:
  triage:
    runs-on: ubuntu-latest
    steps:
      - run: |
          echo "New issue: ${{ github.event.issue.title }}"

Correct

on:
  issues:
    types: [opened]
jobs:
  triage:
    runs-on: ubuntu-latest
    steps:
      - env:
          TITLE: ${{ github.event.issue.title }}
        run: |
          echo "New issue: $TITLE"

Fix

Pass the value through an environment variable (env: TITLE: ${{ github.event.issue.title }}) and use "$TITLE" in the script.

Not flagged

• Expressions the repository controls: github.repository, github.sha, inputs.*, secrets.*.
• The same expression in env: or with:, where it is a value, not code.