From 262d112311797c864edbba67021d3c6188f8b302 Mon Sep 17 00:00:00 2001 From: Derrick Williams Date: Fri, 12 Jun 2026 08:24:29 -0400 Subject: [PATCH] Potential fix for Environment variable built from user-controlled sources Co-authored-by: Copilot Autofix powered by AI <62310815+github-advanced-security[bot]@users.noreply.github.com> --- .../beam_Publish_Beam_SDK_Snapshots.yml | 17 +++++++++++++++-- 1 file changed, 15 insertions(+), 2 deletions(-) diff --git a/.github/workflows/beam_Publish_Beam_SDK_Snapshots.yml b/.github/workflows/beam_Publish_Beam_SDK_Snapshots.yml index 526abfd4e30b..c891694bc0f5 100644 --- a/.github/workflows/beam_Publish_Beam_SDK_Snapshots.yml +++ b/.github/workflows/beam_Publish_Beam_SDK_Snapshots.yml @@ -88,8 +88,21 @@ jobs: # This is needed to run pipelines that use the default environment at HEAD, for example, when a # pipeline uses an expansion service built from HEAD. run: | - BEAM_VERSION_LINE=$(cat gradle.properties | grep "sdk_version") - echo "BEAM_VERSION=${BEAM_VERSION_LINE#*sdk_version=}" >> $GITHUB_ENV + BEAM_VERSION_LINE=$(grep -m1 '^sdk_version=' gradle.properties || true) + if [ -z "$BEAM_VERSION_LINE" ]; then + echo "Could not find sdk_version in gradle.properties" + exit 1 + fi + + BEAM_VERSION="${BEAM_VERSION_LINE#sdk_version=}" + + # Prevent environment file injection via CR/LF. + if printf '%s' "$BEAM_VERSION" | grep -q $'[\r\n]'; then + echo "Invalid sdk_version: contains newline characters" + exit 1 + fi + + printf 'BEAM_VERSION=%s\n' "$BEAM_VERSION" >> "$GITHUB_ENV" - name: Set latest tag only on master branch if: github.ref == 'refs/heads/master' run: echo "LATEST_TAG=,latest" >> $GITHUB_ENV