Commit 811b090
committed
Avoid potentialy user-controlled template expansion in workflows
I don't believe `do_no_merge.yml` is unsafe, but there's no need to echo
the environment variable (it'll either pass or fail based on the value
anyway.)
I also don't think the `circleci.yml` context variable is vulnerable,
but zizmor warns about it, and it's easy to avoid if turns out to be
vulnerable.1 parent 5b9f4bc commit 811b090
2 files changed
+3
-2
lines changed| Original file line number | Diff line number | Diff line change | |
|---|---|---|---|
| |||
34 | 34 | | |
35 | 35 | | |
36 | 36 | | |
| 37 | + | |
| 38 | + | |
37 | 39 | | |
38 | | - | |
| 40 | + | |
39 | 41 | | |
40 | 42 | | |
41 | 43 | | |
| |||
| Original file line number | Diff line number | Diff line change | |
|---|---|---|---|
| |||
23 | 23 | | |
24 | 24 | | |
25 | 25 | | |
26 | | - | |
27 | 26 | | |
28 | 27 | | |
29 | 28 | | |
| |||
0 commit comments