axodotdev / axodotdev/cargo-dist
harden against shell injection attacks in the generated scripts
Open
feature request
- Dominant language
- Rust
- Stars
- 2.1k
- Forks
- 149
- Avg merge
- 1d 11h
- Merged PRs (30d)
- 32
Description
I'm like 80% sure we don't properly quote some things, like this $CHANGELOG_TITLE use is probably bad?
https://github.com/axodotdev/cargo-dist/blob/344c997a5a62927bbf9a95ada97ddf0f3a1e5388/.github/workflows/release.yml#L112
Not *super* concerning since these only run when a git tag is pushed to main but...
Contributor guide
Research direction
Start with .github/workflows/release.yml at line 112 and inspect how CHANGELOG_TITLE is inserted into generated scripts. Trace other generated-script values for similar quoting risks, then verify that tag-triggered release workflows preserve intended values without allowing shell injection.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- github-actions, shell
- Domain
- ci-cd, security
- Issue type
- Bug
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 30/100