c-py/action-dotenv-to-setenv

GitHub Action to export a dotenv file to environment variables (via set-env)

action-dotenv-to-setenv's Issues

Problem when NODE_OPTIONS is in the .env file

A recent change to the Github Actions here: https://github.blog/changelog/2023-10-05-github-actions-node_options-is-now-restricted-from-github_env/#:~:text=Due%20to%20security%20restrictions%2C%20users,parameter%20using%20'%24GITHUB_ENV'%20command now restricts setting NODE_OPTIONS using $GITHUB_ENV. So this happens now when using this action-dotenv-to-setenv action if your .env file contains the NODE_OPTIONS variable.

Not sure what a workaround would be, since we need this in .env for our local development. Maybe there needs to be a way to specify a filter so that variable is skipped when exporting it to $GITHUB_ENV?

Command Injection via the `.env` file

Hi @c-py,

The action is vulnerable to a command injection vulnerability. This makes workflows that use the action in pull_request_target and other contexts with read/write access vulnerable.

You may contact me @nikitastupin on Telegram or _nikitastupin on Twitter if you have questions or doubts.

P.S. I tried to find a private channel of communication with no luck so the only way was to fill the issue publicly.

Steps to Reproduce

Create the .env file with the following contents:

TEST='"; echo "untrusted code execution!" >&2 #'

Run ./dotenv.sh script. You should see the following output:

untrusted code execution!
dotenv.sh: line 66: $GITHUB_ENV: ambiguous redirect

Remediation

I would suggest to avoid using eval as part of the action logic.

Deprecation of 'set-env' in GH actions

Hello,

the use of set-env in GH actions is now deprecated:

https://github.blog/changelog/2020-10-01-github-actions-deprecating-set-env-and-add-path-commands/

Now an environment variable can be set with:

echo "VARIABLE=value" >> $GITHUB_ENV

In the following steps the variable can be used with: {{ env.VARIABLE }}, just like before.

Syntax Error when special Characters are in the .env file

In our project we have an environment variable where there are (...) parantheses in the value. This causes the github action to fail with a syntax error in entrypoint.sh: unexpected character on line 1: "(".

This can be circumvented by surrounding the environment variable value with "..." double or single quotes, maybe this could be suggested in the README of this repo or somehow the syntax error could be fixed.

When variable ends with `=`, it is removed

I have a variable ending with =:

MY_VAR=abc...xyz=

But the final = is trimmed away, so what I receive is only abc...xyz.

Workaround: Quote the value:

MY_VAR="abc...xyz="

`!` character

Any environmental variable containing an exclamation point character will throw the following error:

/entrypoint.sh: eval: line 1: syntax error: unterminated quoted string

does not work on macos!?