Skip to content

ci: fix expression injection pattern in l10n workflow#2319

Open
XananasX7 wants to merge 3 commits into
git:masterfrom
XananasX7:fix/workflow-expression-injection-l10n
Open

ci: fix expression injection pattern in l10n workflow#2319
XananasX7 wants to merge 3 commits into
git:masterfrom
XananasX7:fix/workflow-expression-injection-l10n

Conversation

@XananasX7
Copy link
Copy Markdown

The l10n.yml workflow injects GitHub Actions expressions directly into shell run steps:

base=${{ github.event.pull_request.base.sha }}
head=${{ github.event.pull_request.head.sha }}
base=${{ github.event.before }}
head=${{ github.event.after }}

While these values happen to be hex SHAs, the pattern is flagged by security scanners (zizmor, actionlint) and violates GitHub's security hardening best practices.

Fix: move expressions into env vars and reference env vars in the shell script.

Ref: https://docs.github.com/en/actions/security-for-github-actions/security-guides/security-hardening-for-github-actions#understanding-the-risk-of-script-injections

Signed-off-by: El Mehdi Abenhazou <mehdiananas007@gmail.com>
@gitgitgadget-git
Copy link
Copy Markdown

Welcome to GitGitGadget

Hi @XananasX7, and welcome to GitGitGadget, the GitHub App to send patch series to the Git mailing list from GitHub Pull Requests.

Please make sure that either:

  • Your Pull Request has a good description, if it consists of multiple commits, as it will be used as cover letter.
  • Your Pull Request description is empty, if it consists of a single commit, as the commit message should be descriptive enough by itself.

You can CC potential reviewers by adding a footer to the PR description with the following syntax:

CC: Revi Ewer <revi.ewer@example.com>, Ill Takalook <ill.takalook@example.net>

NOTE: DO NOT copy/paste your CC list from a previous GGG PR's description,
because it will result in a malformed CC list on the mailing list. See
example.

Also, it is a good idea to review the commit messages one last time, as the Git project expects them in a quite specific form:

  • the lines should not exceed 76 columns,
  • the first line should be like a header and typically start with a prefix like "tests:" or "revisions:" to state which subsystem the change is about, and
  • the commit messages' body should be describing the "why?" of the change.
  • Finally, the commit messages should end in a Signed-off-by: line matching the commits' author.

It is in general a good idea to await the automated test ("Checks") in this Pull Request before contributing the patches, e.g. to avoid trivial issues such as unportable code.

Contributing the patches

Before you can contribute the patches, your GitHub username needs to be added to the list of permitted users. Any already-permitted user can do that, by adding a comment to your PR of the form /allow. A good way to find other contributors is to locate recent pull requests where someone has been /allowed:

Both the person who commented /allow and the PR author are able to /allow you.

An alternative is the channel #git-devel on the Libera Chat IRC network:

<newcontributor> I've just created my first PR, could someone please /allow me? https://github.com/gitgitgadget/git/pull/12345
<veteran> newcontributor: it is done
<newcontributor> thanks!

Once on the list of permitted usernames, you can contribute the patches to the Git mailing list by adding a PR comment /submit.

If you want to see what email(s) would be sent for a /submit request, add a PR comment /preview to have the email(s) sent to you. You must have a public GitHub email address for this. Note that any reviewers CC'd via the list in the PR description will not actually be sent emails.

After you submit, GitGitGadget will respond with another comment that contains the link to the cover letter mail in the Git mailing list archive. Please make sure to monitor the discussion in that thread and to address comments and suggestions (while the comments and suggestions will be mirrored into the PR by GitGitGadget, you will still want to reply via mail).

If you do not want to subscribe to the Git mailing list just to be able to respond to a mail, you can download the mbox from the Git mailing list archive (click the (raw) link), then import it into your mail program. If you use GMail, you can do this via:

curl -g --user "<EMailAddress>:<Password>" \
    --url "imaps://imap.gmail.com/INBOX" -T /path/to/raw.txt

To iterate on your change, i.e. send a revised patch or patch series, you will first want to (force-)push to the same branch. You probably also want to modify your Pull Request description (or title). It is a good idea to summarize the revision by adding something like this to the cover letter (read: by editing the first comment on the PR, i.e. the PR description):

Changes since v1:
- Fixed a typo in the commit message (found by ...)
- Added a code comment to ... as suggested by ...
...

To send a new iteration, just add another PR comment with the contents: /submit.

Need help?

New contributors who want advice are encouraged to join git-mentoring@googlegroups.com, where volunteers who regularly contribute to Git are willing to answer newbie questions, give advice, or otherwise provide mentoring to interested contributors. You must join in order to post or view messages, but anyone can join.

You may also be able to find help in real time in the developer IRC channel, #git-devel on Libera Chat. Remember that IRC does not support offline messaging, so if you send someone a private message and log out, they cannot respond to you. The scrollback of #git-devel is archived, though.

@github-actions
Copy link
Copy Markdown

github-actions Bot commented Jun 3, 2026

Errors and warnings found by git-po-helper in workflow #9366:

INFO: no missing blobs of po/* in partial clone
❌ Commit subject
    ERROR    commit c261aa1: subject ("ci: fix committer ...") does not have prefix "l10n:"
❌ Commit message body
    ERROR    commit c261aa1: empty body of the commit message, no s-o-b signature
❌ Commit subject
    ERROR    commit 66bca60: subject ("ci: fix expression ...") does not have prefix "l10n:"
❌ Commit message body
    ERROR    commit 66bca60: empty body of the commit message, no s-o-b signature
⚠️ Author and committer
    WARNING  commit ce959ab: author (El Mehdi Abenhazou <mehdiananas007@gmail.com>) and committer (XananasX <cihbank069@gmail.com>) are different
❌ Commit subject
    ERROR    commit ce959ab: subject ("ci: fix expression ...") does not have prefix "l10n:"
INFO: checking commits: 0 passed, 3 failed.
ERROR: check-commits command failed

@XananasX7
Copy link
Copy Markdown
Author

Thanks for the review. The git-po-helper warning about author vs committer email mismatch — I'll fix the commit authorship so both author and committer use the same email. The l10n workflow fix itself (moving ${{ github.event.pull_request.number }} to an env var) is the right approach per GitHub's security hardening guide. I'll amend and push a clean commit.

@gitgitgadget-git
Copy link
Copy Markdown

There are issues in commit 66bca60:
ci: fix expression injection in l10n workflow

  • Commit checks stopped - the message is too short
  • Commit not signed off

@gitgitgadget-git
Copy link
Copy Markdown

There are issues in commit 66bca60:
ci: fix expression injection in l10n workflow

  • Commit checks stopped - the message is too short
  • Commit not signed off

@gitgitgadget-git
Copy link
Copy Markdown

There are issues in commit c261aa1:
ci: fix committer identity

  • Commit checks stopped - the message is too short
  • Commit not signed off

@dscho
Copy link
Copy Markdown
Member

dscho commented Jun 3, 2026

@XananasX7 you're supposed to squash the fixups before submitting the patch. Also, you will want to avoid being ignored due to a commit message that is vastly different from existing ones. I suggest getting inspired by https://github.blog/2022-06-30-write-better-commits-build-better-projects/ to improve it, in particular with a strong focus on this part:

  What you’re doing Why you’re doing it
High-level (strategic) Intent (what does this accomplish?) Context (why does the code do what it does now?)
Low-level (tactical) Implementation (what did you do to accomplish your goal?) Justification (why is this change being made?)

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants