ddcc icon indicating copy to clipboard operation
ddcc copied to clipboard

sanitize github workflow variables

Open litlfred opened this issue 4 months ago • 0 comments

in publication-request.yaml there are commands such as: echo "Sequence: $SEQUENCE"

if $SEQUENCE contains a quote it's allowed to break out of the string. Imagine $SEQUNCE was file";touch "pwned.yml (yes, that is a valid file name), the code would become echo "Hello, the path to this workflow is file";touch "pwned.yml"

please review all the github workflows and make sure variables are properly escaped/sanitized

litlfred avatar Sep 16 '25 13:09 litlfred