fix(ci): pass untrusted PR data via env to block shell injection (MAPPS-307) #370

Merged

Claude-Run merged 1 commit from fix/MAPPS-307-shell-injection-pr-title into main

2026-06-26 09:21:54 +02:00

Claude-Run commented

2026-06-26 09:20:21 +02:00

Member

The Claude Fix workflow interpolated attacker-controlled PR-payload values directly into run: script bodies, where a crafted PR title (or branch name) could break out of the surrounding context and execute arbitrary shell. A title like $(...) or a branch name with command substitution would be expanded by the workflow templater into the script before the shell ran.

Route every untrusted value through an env: mapping and reference it as a quoted "$VAR" so the content is treated as inert data, mirroring the existing pattern in the 'Commit and push' step:

Build failure context: PR_NUMBER, PR_TITLE, PR_BRANCH, HEAD_SHA.
Run Claude Code: CONTEXT_FILE and the dispatcher-supplied EXTRA_INSTRUCTIONS.
Commit and push: PR_BRANCH on the git push line (a malicious branch name in double quotes still triggered command substitution after template expansion).

Trusted GitHub contexts (secrets.*, github.server_url, github.repository) and action with: inputs are left as direct expressions since they are not shell-parsed untrusted data.

#MAPPS-307

The Claude Fix workflow interpolated attacker-controlled PR-payload values directly into `run:` script bodies, where a crafted PR title (or branch name) could break out of the surrounding context and execute arbitrary shell. A title like `$(...)` or a branch name with command substitution would be expanded by the workflow templater into the script before the shell ran. Route every untrusted value through an `env:` mapping and reference it as a quoted `"$VAR"` so the content is treated as inert data, mirroring the existing pattern in the 'Commit and push' step: - Build failure context: PR_NUMBER, PR_TITLE, PR_BRANCH, HEAD_SHA. - Run Claude Code: CONTEXT_FILE and the dispatcher-supplied EXTRA_INSTRUCTIONS. - Commit and push: PR_BRANCH on the `git push` line (a malicious branch name in double quotes still triggered command substitution after template expansion). Trusted GitHub contexts (`secrets.*`, `github.server_url`, `github.repository`) and action `with:` inputs are left as direct expressions since they are not shell-parsed untrusted data. #MAPPS-307

Claude-Run added 1 commit

2026-06-26 09:20:21 +02:00

fix(ci): pass untrusted PR data via env to block shell injection (MAPPS-307)

Check / fmt + clippy + tests (pull_request) Successful in 1m25s

Details

Create release / Create release from merged PR (pull_request) Has been skipped

Details

ecf1076a9b

The Claude Fix workflow interpolated attacker-controlled PR-payload values directly into `run:` script bodies, where a crafted PR title (or branch name) could break out of the surrounding context and execute arbitrary shell. A title like `$(...)` or a branch name with command substitution would be expanded by the workflow templater into the script before the shell ran.

Route every untrusted value through an `env:` mapping and reference it as a quoted `"$VAR"` so the content is treated as inert data, mirroring the existing pattern in the 'Commit and push' step:
- Build failure context: PR_NUMBER, PR_TITLE, PR_BRANCH, HEAD_SHA.
- Run Claude Code: CONTEXT_FILE and the dispatcher-supplied EXTRA_INSTRUCTIONS.
- Commit and push: PR_BRANCH on the `git push` line (a malicious branch name in double quotes still triggered command substitution after template expansion).

Trusted GitHub contexts (`secrets.*`, `github.server_url`, `github.repository`) and action `with:` inputs are left as direct expressions since they are not shell-parsed untrusted data.

#MAPPS-307