dotCMS / dotCMS/core

Fix command substitution vulnerability in issue linking workflow

Open Beginner friendly
#34,681 1 comment 0 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

Area : CI/CD stale Team : Enablement
Dominant language
Java
Stars
970
Forks
486
Avg merge
3d 33m
Merged PRs (30d)
170

Description

Problem Statement

The issue_comp_link-issue-to-pr.yml workflow fails when PR bodies contain backticks due to unquoted variable expansion in bash. When the PR body includes text like `change-detection: 'enabled'`, bash interprets the backticks as command substitution and attempts to execute the content as a command, resulting in exit code 127 (command not found).

Impact: The issue linking workflow fails for any PR with backticks in the description, preventing automatic issue-to-PR linking.

Example failure: https://github.com/dotCMS/core/actions/runs/22108485819/job/63897956233

Steps to Reproduce

  1. Create a PR with backticks in the body, e.g.: `some-value`
  2. The Add Issue to PR / link-issue workflow triggers
  3. The "Debug workflow inputs" step fails with exit code 127
  4. Error: ##[error]Process completed with exit code 127

Root cause location: .github/workflows/issue_comp_link-issue-to-pr.yml lines 38-44:

- name: Debug workflow inputs
  run: |
    echo "PR Body: ${{ inputs.pr_body }}"  # Backticks cause command substitution

Acceptance Criteria

  • Fix the "Debug workflow inputs" step to properly escape/quote PR body content
  • Validate fix with actionlint (available via mise - run actionlint .github/workflows/)
  • Ensure all other steps that echo inputs are also properly escaped
  • Test with a PR containing backticks, single quotes, and double quotes in the body

dotCMS Version

N/A - CI/CD infrastructure issue

Severity

Medium - Some functionality impacted

Links

Contributor guide

Open the contributing guide

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Research direction

Start with .github/workflows/issue_comp_link-issue-to-pr.yml, especially the “Debug workflow inputs” step at lines 38-44, and inspect other steps that echo inputs. Run actionlint .github/workflows/ via mise, then test the workflow with PR bodies containing backticks, single quotes, and double quotes. Done means the workflow no longer fails with exit code 127 and all input output is safely handled.

Written by the indexing model from the issue text.

Assessment

Tech stack
bash, github-actions, yaml
Domain
ci-cd, devops
Issue type
Bug
Difficulty
2/5
Estimated time
1-3 hours
Activity status
Stale
Clarity
Clearly specified
Newbie friendliness
62/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.