Block unexpected workflow commands

Don't process workflow commands when logging potentially untrusted text
2021-10-10 18:30:36 +01:00
parent 0f23c5436c
commit 3042c8d89d
1 changed files with 11 additions and 0 deletions
@@ -1,14 +1,25 @@
 const fs = require("fs");
+const crypto = require("crypto");
+
+const resumeToken = crypto.randomBytes(30).toString("base64")

 // Output environment variables. Secrets are automatically masked.
 console.log("::group::Environment variables")
+console.log(`::stop-commands::${resumeToken}`)
+
 for (const [key, value] of Object.entries(process.env).sort()) {
  console.log(`${key}=${value}`);
 }
+
+console.log(`::${resumeToken}::`)
 console.log("::endgroup::")

 // Output prettified event JSON.
 console.log("::group::Event JSON")
+console.log(`::stop-commands::${resumeToken}`)
+
 const event = JSON.parse(fs.readFileSync(process.env["GITHUB_EVENT_PATH"]));
 console.log(JSON.stringify(event, null, 2));
+
+console.log(`::${resumeToken}::`)
 console.log("::endgroup::")