You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Using user-controlled input in GitHub Actions may lead to code injection in contexts like _run:_ or _script:_.
4
+
5
+
Code injection in GitHub Actions may allow an attacker to exfiltrate any secrets used in the workflow and the temporary GitHub repository authorization token. The token may have write access to the repository, allowing an attacker to make changes to the repository.
6
+
7
+
## Recommendation
8
+
9
+
The best practice to avoid code injection vulnerabilities in GitHub workflows is to set the untrusted input value of the expression to an intermediate environment variable and then use the environment variable using the native syntax of the shell/script interpreter (that is, not _${{ env.VAR }}_).
10
+
11
+
It is also recommended to limit the permissions of any tokens used by a workflow such as the GITHUB_TOKEN.
12
+
13
+
## Example
14
+
15
+
### Incorrect Usage
16
+
17
+
The following example lets attackers inject an arbitrary shell command:
18
+
19
+
```yaml
20
+
on: issue_comment
21
+
22
+
jobs:
23
+
echo-body:
24
+
runs-on: ubuntu-latest
25
+
steps:
26
+
- run: |
27
+
echo '${{ github.event.comment.body }}'
28
+
```
29
+
30
+
The following example uses an environment variable, but **still allows the injection** because of the use of expression syntax:
31
+
32
+
```yaml
33
+
on: issue_comment
34
+
35
+
jobs:
36
+
echo-body:
37
+
runs-on: ubuntu-latest
38
+
steps:
39
+
- env:
40
+
BODY: ${{ github.event.issue.body }}
41
+
run: |
42
+
echo '${{ env.BODY }}'
43
+
```
44
+
45
+
### Correct Usage
46
+
47
+
The following example uses shell syntax to read the environment variable and will prevent the attack:
48
+
49
+
```yaml
50
+
jobs:
51
+
echo-body:
52
+
runs-on: ubuntu-latest
53
+
steps:
54
+
- env:
55
+
BODY: ${{ github.event.issue.body }}
56
+
run: |
57
+
echo "$BODY"
58
+
```
59
+
60
+
The following example uses `process.env` to read environment variables within JavaScript code.
61
+
62
+
```yaml
63
+
jobs:
64
+
echo-body:
65
+
runs-on: ubuntu-latest
66
+
steps:
67
+
- uses: uses: actions/github-script@v4
68
+
env:
69
+
BODY: ${{ github.event.issue.body }}
70
+
with:
71
+
script: |
72
+
const { BODY } = process.env
73
+
...
74
+
```
75
+
76
+
## References
77
+
78
+
- GitHub Security Lab Research: [Keeping your GitHub Actions and workflows secure: Untrusted input](https://securitylab.github.com/research/github-actions-untrusted-input).
79
+
- GitHub Docs: [Security hardening for GitHub Actions](https://docs.github.com/en/actions/security-guides/security-hardening-for-github-actions).
80
+
- GitHub Docs: [Permissions for the GITHUB_TOKEN](https://docs.github.com/en/actions/security-guides/automatic-token-authentication#permissions-for-the-github_token).
0 commit comments