hanzoai/sentinel
2
0
Fork 0
mirror of https://github.com/hanzoai/sentinel.git synced 2026-09-29 22:34:33 +00:00
Code Issues Packages Projects Releases Wiki Activity

fix: Prevent script injection vulnerability in get-compose-action (#4179)

Browse Source 
fix: Prevent script injection in get-compose-action

Use environment variable to pass inputs.version instead of direct
interpolation in run script to prevent potential script injection.

Refs: DI-967, VULN-761

Co-authored-by: fix-it-felix-sentry[bot] <260785270+fix-it-felix-sentry[bot]@users.noreply.github.com>
This commit is contained in:
fix-it-felix-sentry[bot]
2026-02-19 16:47:10 +07:00
committed by GitHub
co-authored by fix-it-felix-sentry[bot] <260785270+fix-it-felix-sentry[bot]@users.noreply.github.com>
parent c2ed7f7206
commit 4e2f38e391
1 changed files with 3 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files
get-compose-action/action.yaml
+3 -1
View File
@@ -10,10 +10,12 @@ runs:
steps:
- name: Get Compose
shell: bash
env:
COMPOSE_VERSION: ${{ inputs.version }}
run: |
# Docker Compose v1 is installed here, remove it
sudo rm -f "/usr/local/bin/docker-compose"
sudo rm -f "/usr/local/lib/docker/cli-plugins/docker-compose"
sudo mkdir -p "/usr/local/lib/docker/cli-plugins"
sudo curl -L https://github.com/docker/compose/releases/download/v${{ inputs.version }}/docker-compose-`uname -s`-`uname -m` -o "/usr/local/lib/docker/cli-plugins/docker-compose"
sudo curl -L https://github.com/docker/compose/releases/download/v"$COMPOSE_VERSION"/docker-compose-`uname -s`-`uname -m` -o "/usr/local/lib/docker/cli-plugins/docker-compose"
sudo chmod +x "/usr/local/lib/docker/cli-plugins/docker-compose"