Skip to content

fix: avoid potential code injection #177

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom
Merged
merged 3 commits into from
Aug 17, 2025
Merged

fix: avoid potential code injection #177

merged 3 commits into from
Aug 17, 2025

Conversation

Fdawgs
Copy link
Member

@Fdawgs Fdawgs commented Aug 15, 2025 •
edited
Loading

This was covered in the GitHub Secure Open Source Fund program that Fastify participated in.
See https://securitylab.github.com/resources/github-actions-untrusted-input/ for supporting documentation.

Checklist

gurgunday
gurgunday approved these changes Aug 15, 2025
View reviewed changes
Copy link
Member

@gurgunday gurgunday left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

lgtm

@Fdawgs Fdawgs requested a review from Eomm August 15, 2025 08:41
RafaelGSS
RafaelGSS approved these changes Aug 16, 2025
View reviewed changes
Copy link
Member

@RafaelGSS RafaelGSS left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

IIRC the matrix.node-version isn't a untrusted input as we have the versions fixed in the workflow.

Anyway, LGTM

@Fdawgs
Copy link
Member Author

Fdawgs commented Aug 17, 2025

IIRC the matrix.node-version isn't a untrusted input as we have the versions fixed in the workflow.

That was just to stop the codeql false positives constantly popping up. 😬

Uzlopak
Uzlopak approved these changes Aug 17, 2025
View reviewed changes
Copy link
Contributor

@Uzlopak Uzlopak left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM

mcollina
mcollina approved these changes Aug 17, 2025
View reviewed changes
Copy link
Member

@mcollina mcollina left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

lgtm

@Uzlopak Uzlopak merged commit c898d5e into main Aug 17, 2025
3 checks passed
@Uzlopak Uzlopak deleted the fix/code-injection branch August 17, 2025 08:34
@optic-release-automation optic-release-automation bot mentioned this pull request Aug 21, 2025
Merged
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Reviewers

@mcollina mcollina mcollina approved these changes

@Uzlopak Uzlopak Uzlopak approved these changes

@dancastillo dancastillo dancastillo approved these changes

@gurgunday gurgunday gurgunday approved these changes

@Eomm Eomm Awaiting requested review from Eomm

+1 more reviewer

@RafaelGSS RafaelGSS RafaelGSS approved these changes

Reviewers whose approvals may not affect merge requirements
Assignees
No one assigned
Labels
None yet
Projects
None yet
Milestone
No milestone
Development

Successfully merging this pull request may close these issues.
6 participants
@Fdawgs @mcollina @Uzlopak @dancastillo @RafaelGSS @gurgunday