Update tj-actions/verify-changed-files action to v17 [SECURITY] - #509
Open
renovate[bot] wants to merge 1 commit into
Open
Update tj-actions/verify-changed-files action to v17 [SECURITY]#509renovate[bot] wants to merge 1 commit into
renovate[bot] wants to merge 1 commit into
Conversation
renovate
Bot
added
automerge
dependencies
renovate
Bot
added
dependencies
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
This PR contains the following updates:
v10→v17Potential Actions command injection in output filenames (GHSL-2023-275)
CVE-2023-52137 / GHSA-ghm2-rq8q-wrhc
More information
Details
Summary
The
tj-actions/verify-changed-filesaction allows for command injection in changed filenames, allowing an attacker to execute arbitrary code and potentially leak secrets.Details
The
verify-changed-filesworkflow returns the list of files changed within a workflow execution.This could potentially allow filenames that contain special characters such as
;and ` (backtick) which can be used by an attacker to take over the GitHub Runner if the output value is used in a raw fashion (thus being directly replaced before execution) inside arunblock. By running custom commands an attacker may be able to steal secrets such asGITHUB_TOKENif triggered on other events thanpull_request. For example onpush.Proof of Concept
$(whoami).txtwould be a valid filename.List all changed files tracked and untracked filesstep.Example output:
Impact
This issue may lead to arbitrary command execution in the GitHub Runner.
Resolution
A new
safe_outputinput would be enabled by default and return filename paths escaping special characters like ;, ` (backtick), $, (), etc for bash environments.A safe recommendation of using environment variables to store unsafe outputs.
Resources
Severity
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:L/A:LReferences
This data is provided by the GitHub Advisory Database (CC-BY 4.0).
Release Notes
tj-actions/verify-changed-files (tj-actions/verify-changed-files)
v17.0.0Compare Source
🔥 🔥 BREAKING CHANGE 🔥 🔥
A new
safe_outputinput is now available to prevent outputting unsafe filename characters (Enabled by default). This would escape characters in the filename that could be used for command injection.Example
... - name: Verify Changed files uses: tj-actions/verify-changed-files@v16 id: verify-changed-files with: safe_output: false # set to false because we are using an environment variable to store the output and avoid command injection. - name: List all changed tracked and untracked files env: FILES_CHANGED: ${{ steps.verify-changed-files.outputs.changed_files }} run: | echo "Changed files: $FILES_CHANGED ...What's Changed
Full Changelog: tj-actions/verify-changed-files@v16...v17.0.0
v17Compare Source
🔄 Update
📝 Other
⚙️ Miscellaneous Tasks
⬆️ Upgrades
Co-authored-by: jackton1 <jackton1@users.noreply.github.com> (58f5ac7) - (tj-actions[bot])
v16.1.1Compare Source
📦 Bumps
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
(6d68896) - (dependabot[bot])
➕ Add
➖ Remove
🔄 Update
(f151bce) - (jackton1)
(3571d65) - (jackton1)
(47f2c87) - (jackton1)
(301fce7) - (jackton1)
📝 Other
feat: add
safe_outputinput enabled by defaultfix: migrate README to safe uses of interpolation
fix: also sanitize
)fix: remove sanitization of
'fix: also sanitize
|fix: also sanitize
&fix: also sanitize
;(498d3f3) - (Jorge)⚙️ Miscellaneous Tasks
⬆️ Upgrades
(e9aaab7) - (jackton1)
v16.1.0Compare Source
🐛 Bug Fixes
🔄 Update
📝 Other
⚙️ Miscellaneous Tasks
8ade135(5b70b3d) - (renovate[bot])⬆️ Upgrades
(bbade59) - (jackton1)
v16.0.1Compare Source
🐛 Bug Fixes
➕ Add
fail-if-changedoption (#321)Add
fail-if-changedoptionUpdate entrypoint.sh
Update test.yml
Co-authored-by: Tonye Jack jtonye@ymail.com (167811b) - (Minecraftschurli)
➖ Remove
🔄 Update
(e74de09) - (jackton1)
(c5f7ef3) - (jackton1)
Co-authored-by: jackton1 <jackton1@users.noreply.github.com> (1b0a45f) - (tj-actions[bot])
(796d6c7) - (repo-ranger[bot])
📚 Documentation
📝 Other
⚙️ Miscellaneous Tasks
⬆️ Upgrades
(c103512) - (jackton1)
v16.0.0Compare Source
What's Changed
Full Changelog: tj-actions/verify-changed-files@v15...v16.0.0
v16Compare Source
📦 Bumps
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
(6d68896) - (dependabot[bot])
➕ Add
➖ Remove
🔄 Update
(f151bce) - (jackton1)
(3571d65) - (jackton1)
(47f2c87) - (jackton1)
(301fce7) - (jackton1)
📝 Other
feat: add
safe_outputinput enabled by defaultfix: migrate README to safe uses of interpolation
fix: also sanitize
)fix: remove sanitization of
'fix: also sanitize
|fix: also sanitize
&fix: also sanitize
;(498d3f3) - (Jorge)⚙️ Miscellaneous Tasks
⬆️ Upgrades
(e9aaab7) - (jackton1)
v15.0.2Compare Source
⚙️ Miscellaneous Tasks
⬆️ Upgrades
Co-authored-by: jackton1 <jackton1@users.noreply.github.com>
Co-authored-by: repo-ranger[bot] <39074581+repo-ranger[bot]@users.noreply.github.com> (7f1b21c) - (tj-actions[bot])
v15.0.1Compare Source
⚙️ Miscellaneous Tasks
⬆️ Upgrades
Co-authored-by: jackton1 <jackton1@users.noreply.github.com>
Co-authored-by: repo-ranger[bot] <39074581+repo-ranger[bot]@users.noreply.github.com> (7f1b21c) - (tj-actions[bot])
v15.0.0Compare Source
📦 Bumps
Bumps peter-evans/create-pull-request from 5.0.1 to 5.0.2.
updated-dependencies:
dependency-type: direct:production
update-type: version-update:semver-patch
...
Signed-off-by: dependabot[bot] support@github.com (c7e0237) - (dependabot[bot])
⚙️ Miscellaneous Tasks
⬆️ Upgrades
Co-authored-by: jackton1 <jackton1@users.noreply.github.com> (0dffb60) - (tj-actions[bot])
v15Compare Source
⚙️ Miscellaneous Tasks
⬆️ Upgrades
Co-authored-by: jackton1 <jackton1@users.noreply.github.com>
Co-authored-by: repo-ranger[bot] <39074581+repo-ranger[bot]@users.noreply.github.com> (7f1b21c) - (tj-actions[bot])
v14.0.2Compare Source
🚀 Features
📦 Bumps
Bumps peter-evans/create-pull-request from 5.0.0 to 5.0.1.
updated-dependencies:
dependency-type: direct:production
update-type: version-update:semver-patch
...
Signed-off-by: dependabot[bot] support@github.com (6ed95ae) - (dependabot[bot])
🔄 Update
(dd9c6e5) - (repo-ranger[bot])
(b78b21b) - (jackton1)
(87a456d) - (jackton1)
📝 Other
⚙️ Miscellaneous Tasks
⬆️ Upgrades
(35b5ede) - (jackton1)
v14.0.1Compare Source
🐛 Bug Fixes
🔄 Update
(5719db1) - (repo-ranger[bot])
📝 Other
⚙️ Miscellaneous Tasks
⬆️ Upgrades
Co-authored-by: jackton1 <jackton1@users.noreply.github.com> (4b248f3) - (Tonye Jack)
v14.0.0Compare Source
🐛 Bug Fixes
🔄 Update
(5719db1) - (repo-ranger[bot])
📝 Other
⚙️ Miscellaneous Tasks
⬆️ Upgrades
Co-authored-by: jackton1 <jackton1@users.noreply.github.com> (4b248f3) - (Tonye Jack)
v14Compare Source
🚀 Features
📦 Bumps
Bumps peter-evans/create-pull-request from 5.0.0 to 5.0.1.
updated-dependencies:
dependency-type: direct:production
update-type: version-update:semver-patch
...
Signed-off-by: dependabot[bot] support@github.com (6ed95ae) - (dependabot[bot])
🔄 Update
(dd9c6e5) - (repo-ranger[bot])
Configuration
📅 Schedule: (UTC)
🚦 Automerge: Enabled.
♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.
🔕 Ignore: Close this PR and you won't be reminded about this update again.
This PR was generated by Mend Renovate. View the repository job log.