Skip to content

Fix shell injection via branch name in pr-auto-commit.yaml #7314

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Closed
Copilot wants to merge 2 commits into from
Closed

Fix shell injection via branch name in pr-auto-commit.yaml #7314

Changes from 1 commit
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
62c6cd3
Initial plan
Copilot Mar 2, 2026
4595819
Fix shell injection via branch name in pr-auto-commit.yaml
Copilot Mar 2, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
Prev Previous commit
Fix shell injection via branch name in pr-auto-commit.yaml 
Co-authored-by: youknowone <69878+youknowone@users.noreply.github.com>
  • Loading branch information
@youknowone
Copilot and youknowone committed Mar 2, 2026
commit 4595819b69ddbb04a75e43398410dbac072ec701
9 changes: 7 additions & 2 deletions .github/workflows/pr-auto-commit.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -93,16 +93,21 @@ jobs:

- name: Push formatting changes
if: steps.check-changes.outputs.has_changes == 'true'
env:
HEAD_REF: ${{ github.event.pull_request.head.ref }}
run: |
git push origin HEAD:${{ github.event.pull_request.head.ref }}
git push origin HEAD:"$HEAD_REF"

- name: Read committed commands
id: committed-commands
if: steps.check-changes.outputs.has_changes == 'true'
env:
HEAD_REF: ${{ github.event.pull_request.head.ref }}
run: |
echo "list<<EOF" >> $GITHUB_OUTPUT
cat /tmp/committed_commands.txt >> $GITHUB_OUTPUT
echo "EOF" >> $GITHUB_OUTPUT
echo "head_ref=$HEAD_REF" >> $GITHUB_OUTPUT

- name: Comment on PR
if: steps.check-changes.outputs.has_changes == 'true'
Expand All @@ -116,5 +121,5 @@ jobs:
${{ steps.committed-commands.outputs.list }}
Please pull the latest changes before pushing again:
```bash
git pull origin ${{ github.event.pull_request.head.ref }}
git pull origin ${{ steps.committed-commands.outputs.head_ref }}
```