Skip to content

Validate pull request metadata inputs#92

Open
kitsuyui wants to merge 1 commit into
mainfrom
fix/audit-action-inputs-unsanitized-in-pr-fields-001
Open

Validate pull request metadata inputs#92
kitsuyui wants to merge 1 commit into
mainfrom
fix/audit-action-inputs-unsanitized-in-pr-fields-001

Conversation

@kitsuyui

Copy link
Copy Markdown
Member

Summary

  • Validate pull request metadata before passing it to peter-evans/create-pull-request.
  • Reject multiline or control-character commit messages and pull request titles, while keeping multiline pull request bodies supported.
  • Document the trust boundary for metadata inputs and add regression coverage for the validator script.

Checks

  • git diff --check
  • typos README.md action.yml .github/workflows/main.yml scripts/validate-pull-request-metadata.sh scripts/test-validate-pull-request-metadata.sh
  • go run mvdan.cc/sh/v3/cmd/shfmt@v3.13.1 -d scripts/*.sh
  • shellcheck scripts/*.sh
  • go run github.com/rhysd/actionlint/cmd/actionlint@v1.7.12 -color
  • scripts/test-validate-pull-request-metadata.sh
  • collateral check: clean
  • foreground implement-validator: overall: pass

Notes

  • pr_body remains multiline Markdown; the new check only rejects unsupported control characters.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant