Fix command substitution vulnerability in issue linking workflow
Nobody has claimed this yet.
- Dominant language
- Java
- Stars
- 970
- Forks
- 486
- Avg merge
- 3d 33m
- Merged PRs (30d)
- 170
Description
Problem Statement
The issue_comp_link-issue-to-pr.yml workflow fails when PR bodies contain backticks due to unquoted variable expansion in bash. When the PR body includes text like `change-detection: 'enabled'`, bash interprets the backticks as command substitution and attempts to execute the content as a command, resulting in exit code 127 (command not found).
Impact: The issue linking workflow fails for any PR with backticks in the description, preventing automatic issue-to-PR linking.
Example failure: https://github.com/dotCMS/core/actions/runs/22108485819/job/63897956233
Steps to Reproduce
- Create a PR with backticks in the body, e.g.: `some-value`
- The
Add Issue to PR / link-issueworkflow triggers - The "Debug workflow inputs" step fails with exit code 127
- Error:
##[error]Process completed with exit code 127
Root cause location: .github/workflows/issue_comp_link-issue-to-pr.yml lines 38-44:
- name: Debug workflow inputs
run: |
echo "PR Body: ${{ inputs.pr_body }}" # Backticks cause command substitution
Acceptance Criteria
- Fix the "Debug workflow inputs" step to properly escape/quote PR body content
- Validate fix with
actionlint(available viamise- runactionlint .github/workflows/) - Ensure all other steps that echo inputs are also properly escaped
- Test with a PR containing backticks, single quotes, and double quotes in the body
dotCMS Version
N/A - CI/CD infrastructure issue
Severity
Medium - Some functionality impacted
Links
- Related PR: https://github.com/dotCMS/core/pull/34680
- Failed workflow run: https://github.com/dotCMS/core/actions/runs/22108485819/job/63897956233
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Start with .github/workflows/issue_comp_link-issue-to-pr.yml, especially the “Debug workflow inputs” step at lines 38-44, and inspect other steps that echo inputs. Run actionlint .github/workflows/ via mise, then test the workflow with PR bodies containing backticks, single quotes, and double quotes. Done means the workflow no longer fails with exit code 127 and all input output is safely handled.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- bash, github-actions, yaml
- Domain
- ci-cd, devops
- Issue type
- Bug
- Difficulty
- 2/5
- Estimated time
- 1-3 hours
- Activity status
- Stale
- Clarity
- Clearly specified
- Newbie friendliness
- 62/100