ci: pass the release tag through env in the docs-sync dispatch - #2294
Open
WAHIB-EL-KHADIRI wants to merge 1 commit into
Open
ci: pass the release tag through env in the docs-sync dispatch#2294WAHIB-EL-KHADIRI wants to merge 1 commit into
WAHIB-EL-KHADIRI wants to merge 1 commit into
Conversation
The tag is interpolated into the github-script body, which is JavaScript
source. A ${{ }} expansion is substituted as text before the script runs,
so a tag containing a single quote terminates the string literal and the
rest executes as code -- in a step holding a cross-repo PAT.
Reading it from process.env keeps it data. Also adds the least-privilege
permissions block the file had never declared.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What
.github/workflows/trigger_sync_remote_docs.ymlinterpolates the release tag directly into anactions/github-scriptbody:target_tag: '${{ github.event.release.tag_name || github.event.inputs.tag_name }}'The
script:block is JavaScript source, and${{ ... }}is substituted as text before the script is parsed — it is not a runtime variable. A tag name containing a single quote closes the string literal and everything after it is evaluated as JavaScript.A tag such as:
ends the call and runs attacker-chosen code in the step.
Why it matters here
This particular step carries
TEN_FRAMEWORK_PORTAL_ACTION_PAT— a token with repo + workflow permissions onTEN-framework/portal. Code execution in this step reaches that token, so the blast radius extends to a second repository.To be clear about severity: both triggers (
release: createdandworkflow_dispatch) require write access, so this is defense in depth rather than an externally reachable vulnerability. It matters because it removes a path from "can push a tag" to "controls the portal PAT" — a meaningful step up in privilege, and one that release automation or a compromised maintainer account could take.The fix
Pass the value through
env:and read it withprocess.env.TARGET_TAG. The environment variable is only ever data, never source text. Behaviour is unchanged.Also adds
permissions: contents: read, which the file had never declared — the job only needs to dispatch through the PAT, not to use the defaultGITHUB_TOKEN.Verification
The workflow parses cleanly, and the
envblock resolves as expected. The diff is three lines plus the permissions block; no logic changed.🤖 Generated with Claude Code