c-py / action-dotenv-to-setenv Goto Github PK
View Code? Open in Web Editor NEWGitHub Action to export a dotenv file to environment variables (via set-env)
License: MIT License
GitHub Action to export a dotenv file to environment variables (via set-env)
License: MIT License
A recent change to the Github Actions here: https://github.blog/changelog/2023-10-05-github-actions-node_options-is-now-restricted-from-github_env/#:~:text=Due%20to%20security%20restrictions%2C%20users,parameter%20using%20'%24GITHUB_ENV'%20command now restricts setting NODE_OPTIONS using $GITHUB_ENV. So this happens now when using this action-dotenv-to-setenv action if your .env
file contains the NODE_OPTIONS variable.
Not sure what a workaround would be, since we need this in .env
for our local development. Maybe there needs to be a way to specify a filter so that variable is skipped when exporting it to $GITHUB_ENV?
Hi @c-py,
The action is vulnerable to a command injection vulnerability. This makes workflows that use the action in pull_request_target
and other contexts with read/write access vulnerable.
You may contact me @nikitastupin on Telegram or _nikitastupin on Twitter if you have questions or doubts.
P.S. I tried to find a private channel of communication with no luck so the only way was to fill the issue publicly.
Create the .env
file with the following contents:
TEST='"; echo "untrusted code execution!" >&2 #'
Run ./dotenv.sh
script. You should see the following output:
untrusted code execution!
dotenv.sh: line 66: $GITHUB_ENV: ambiguous redirect
I would suggest to avoid using eval
as part of the action logic.
Hello,
the use of set-env
in GH actions is now deprecated:
https://github.blog/changelog/2020-10-01-github-actions-deprecating-set-env-and-add-path-commands/
Now an environment variable can be set with:
echo "VARIABLE=value" >> $GITHUB_ENV
In the following steps the variable can be used with: {{ env.VARIABLE }}
, just like before.
In our project we have an environment variable where there are (...)
parantheses in the value. This causes the github action to fail with a syntax error
in entrypoint.sh
: unexpected character on line 1: "("
.
This can be circumvented by surrounding the environment variable value with "..."
double or single quotes, maybe this could be suggested in the README of this repo or somehow the syntax error could be fixed.
I have a variable ending with =
:
MY_VAR=abc...xyz=
But the final =
is trimmed away, so what I receive is only abc...xyz
.
Workaround: Quote the value:
MY_VAR="abc...xyz="
Any environmental variable containing an exclamation point character will throw the following error:
/entrypoint.sh: eval: line 1: syntax error: unterminated quoted string
A declarative, efficient, and flexible JavaScript library for building user interfaces.
๐ Vue.js is a progressive, incrementally-adoptable JavaScript framework for building UI on the web.
TypeScript is a superset of JavaScript that compiles to clean JavaScript output.
An Open Source Machine Learning Framework for Everyone
The Web framework for perfectionists with deadlines.
A PHP framework for web artisans
Bring data to life with SVG, Canvas and HTML. ๐๐๐
JavaScript (JS) is a lightweight interpreted programming language with first-class functions.
Some thing interesting about web. New door for the world.
A server is a program made to process requests and deliver data to clients.
Machine learning is a way of modeling and interpreting data that allows a piece of software to respond intelligently.
Some thing interesting about visualization, use data art
Some thing interesting about game, make everyone happy.
We are working to build community through open source technology. NB: members must have two-factor auth.
Open source projects and samples from Microsoft.
Google โค๏ธ Open Source for everyone.
Alibaba Open Source for everyone
Data-Driven Documents codes.
China tencent open source team.