Skip to content

fix: prevent shell injection through GitLab inputs #193

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
fengmk2 merged 1 commit into from
Oct 10, 2026
+269 −107
Merged

fix: prevent shell injection through GitLab inputs #193

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
2 changes: 2 additions & 0 deletions README.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -456,6 +456,8 @@ test:

### With GitLab Inputs

String inputs are passed as literal environment values. Quotes, dollar signs, and multiline values do not become shell commands. Inputs take precedence over the corresponding `SETUP_VP_*` variables when you extend `.setup-vp` or `.setup-vp-cached`; use `.setup-vp-bootstrap` directly to configure setup through variables instead.

`setup-ref` accepts ASCII letters, digits, underscores, and hyphens, with single dots or slashes between these groups (for example, `v1.21.1` or `refs/tags/v1.21.1`). The templates and bootstrap scripts reject other values before downloading executable files. The same validation applies to `SETUP_VP_SETUP_REF` when using `.setup-vp-bootstrap` directly. Keep this value under maintainer control because it selects code that runs on the runner.

```yaml
Expand Down
92 changes: 53 additions & 39 deletions gitlab/setup-vp-windows.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -73,47 +73,61 @@ spec:
}

.setup-vp:
# Keep string inputs out of shell source and disable variable expansion.
variables:
SETUP_VP_INPUT_VERSION:
value: $[[ inputs.version ]]
expand: false
SETUP_VP_INPUT_VERSION_FILE:
value: $[[ inputs.version-file ]]
expand: false
SETUP_VP_INPUT_NODE_VERSION:
value: $[[ inputs.node-version ]]
expand: false
SETUP_VP_INPUT_NODE_VERSION_FILE:
value: $[[ inputs.node-version-file ]]
expand: false
SETUP_VP_INPUT_CACHE_DEPENDENCY_PATH:
value: $[[ inputs.cache-dependency-path ]]
expand: false
SETUP_VP_INPUT_WORKING_DIRECTORY:
value: $[[ inputs.working-directory ]]
expand: false
SETUP_VP_INPUT_RUN_INSTALL:
value: $[[ inputs.run-install ]]
expand: false
SETUP_VP_INPUT_PACKAGE_MANAGER:
value: $[[ inputs.package-manager ]]
expand: false
SETUP_VP_INPUT_NODE_MANAGER:
value: $[[ inputs.node-manager ]]
expand: false
SETUP_VP_INPUT_REGISTRY_URL:
value: $[[ inputs.registry-url ]]
expand: false
SETUP_VP_INPUT_SCOPE:
value: $[[ inputs.scope ]]
expand: false
SETUP_VP_INPUT_SETUP_REF:
value: $[[ inputs.setup-ref ]]
expand: false
before_script:
- |
$env:SETUP_VP_VERSION = @'
$[[ inputs.version ]]
'@
$env:SETUP_VP_VERSION_FILE = @'
$[[ inputs.version-file ]]
'@
$env:SETUP_VP_NODE_VERSION = @'
$[[ inputs.node-version ]]
'@
$env:SETUP_VP_NODE_VERSION_FILE = @'
$[[ inputs.node-version-file ]]
'@
$env:SETUP_VP_CACHE_DEPENDENCY_PATH = @'
$[[ inputs.cache-dependency-path ]]
'@
$env:SETUP_VP_WORKING_DIRECTORY = @'
$[[ inputs.working-directory ]]
'@
$env:SETUP_VP_RUN_INSTALL = @'
$[[ inputs.run-install ]]
'@
$env:SETUP_VP_SFW = @'
$[[ inputs.sfw ]]
'@
$env:SETUP_VP_PACKAGE_MANAGER = @'
$[[ inputs.package-manager ]]
'@
$env:SETUP_VP_NODE_MANAGER = @'
$[[ inputs.node-manager ]]
'@
$env:SETUP_VP_REGISTRY_URL = @'
$[[ inputs.registry-url ]]
'@
$env:SETUP_VP_SCOPE = @'
$[[ inputs.scope ]]
'@
$env:SETUP_VP_SETUP_REF = @'
$[[ inputs.setup-ref ]]
'@
# Copy inputs at runtime so they still override SETUP_VP_* variables.
$env:SETUP_VP_VERSION = $env:SETUP_VP_INPUT_VERSION
$env:SETUP_VP_VERSION_FILE = $env:SETUP_VP_INPUT_VERSION_FILE
$env:SETUP_VP_NODE_VERSION = $env:SETUP_VP_INPUT_NODE_VERSION
$env:SETUP_VP_NODE_VERSION_FILE = $env:SETUP_VP_INPUT_NODE_VERSION_FILE
$env:SETUP_VP_CACHE_DEPENDENCY_PATH = $env:SETUP_VP_INPUT_CACHE_DEPENDENCY_PATH
$env:SETUP_VP_WORKING_DIRECTORY = $env:SETUP_VP_INPUT_WORKING_DIRECTORY
$env:SETUP_VP_RUN_INSTALL = $env:SETUP_VP_INPUT_RUN_INSTALL
$env:SETUP_VP_PACKAGE_MANAGER = $env:SETUP_VP_INPUT_PACKAGE_MANAGER
$env:SETUP_VP_NODE_MANAGER = $env:SETUP_VP_INPUT_NODE_MANAGER
$env:SETUP_VP_REGISTRY_URL = $env:SETUP_VP_INPUT_REGISTRY_URL
$env:SETUP_VP_SCOPE = $env:SETUP_VP_INPUT_SCOPE
$env:SETUP_VP_SETUP_REF = $env:SETUP_VP_INPUT_SETUP_REF
# GitLab validates these inputs as a boolean and a fixed option list.
$env:SETUP_VP_SFW = '$[[ inputs.sfw ]]'
if ('$[[ inputs.cache-policy ]]' -eq 'pull') { $env:SETUP_VP_CACHE_SAVE = 'false' }
- !reference [.setup-vp-bootstrap, before_script]

Expand Down
118 changes: 53 additions & 65 deletions gitlab/setup-vp.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -101,74 +101,62 @@ spec:
. "$setup_vp_env_tmp"

.setup-vp:
# Keep string inputs out of shell source and disable variable expansion.
variables:
SETUP_VP_INPUT_VERSION:
value: $[[ inputs.version ]]
expand: false
SETUP_VP_INPUT_VERSION_FILE:
value: $[[ inputs.version-file ]]
expand: false
SETUP_VP_INPUT_NODE_VERSION:
value: $[[ inputs.node-version ]]
expand: false
SETUP_VP_INPUT_NODE_VERSION_FILE:
value: $[[ inputs.node-version-file ]]
expand: false
SETUP_VP_INPUT_CACHE_DEPENDENCY_PATH:
value: $[[ inputs.cache-dependency-path ]]
expand: false
SETUP_VP_INPUT_WORKING_DIRECTORY:
value: $[[ inputs.working-directory ]]
expand: false
SETUP_VP_INPUT_RUN_INSTALL:
value: $[[ inputs.run-install ]]
expand: false
SETUP_VP_INPUT_PACKAGE_MANAGER:
value: $[[ inputs.package-manager ]]
expand: false
SETUP_VP_INPUT_NODE_MANAGER:
value: $[[ inputs.node-manager ]]
expand: false
SETUP_VP_INPUT_REGISTRY_URL:
value: $[[ inputs.registry-url ]]
expand: false
SETUP_VP_INPUT_SCOPE:
value: $[[ inputs.scope ]]
expand: false
SETUP_VP_INPUT_SETUP_REF:
value: $[[ inputs.setup-ref ]]
expand: false
before_script:
- |
SETUP_VP_VERSION="$(cat <<'SETUP_VP_VERSION_EOF'
$[[ inputs.version ]]
SETUP_VP_VERSION_EOF
)"
export SETUP_VP_VERSION
SETUP_VP_VERSION_FILE="$(cat <<'SETUP_VP_VERSION_FILE_EOF'
$[[ inputs.version-file ]]
SETUP_VP_VERSION_FILE_EOF
)"
export SETUP_VP_VERSION_FILE
SETUP_VP_NODE_VERSION="$(cat <<'SETUP_VP_NODE_VERSION_EOF'
$[[ inputs.node-version ]]
SETUP_VP_NODE_VERSION_EOF
)"
export SETUP_VP_NODE_VERSION
SETUP_VP_NODE_VERSION_FILE="$(cat <<'SETUP_VP_NODE_VERSION_FILE_EOF'
$[[ inputs.node-version-file ]]
SETUP_VP_NODE_VERSION_FILE_EOF
)"
export SETUP_VP_NODE_VERSION_FILE
SETUP_VP_CACHE_DEPENDENCY_PATH="$(cat <<'SETUP_VP_CACHE_DEPENDENCY_PATH_EOF'
$[[ inputs.cache-dependency-path ]]
SETUP_VP_CACHE_DEPENDENCY_PATH_EOF
)"
export SETUP_VP_CACHE_DEPENDENCY_PATH
# Copy inputs at runtime so they still override SETUP_VP_* variables.
export SETUP_VP_VERSION="$SETUP_VP_INPUT_VERSION"
export SETUP_VP_VERSION_FILE="$SETUP_VP_INPUT_VERSION_FILE"
export SETUP_VP_NODE_VERSION="$SETUP_VP_INPUT_NODE_VERSION"
export SETUP_VP_NODE_VERSION_FILE="$SETUP_VP_INPUT_NODE_VERSION_FILE"
export SETUP_VP_CACHE_DEPENDENCY_PATH="$SETUP_VP_INPUT_CACHE_DEPENDENCY_PATH"
export SETUP_VP_WORKING_DIRECTORY="$SETUP_VP_INPUT_WORKING_DIRECTORY"
export SETUP_VP_RUN_INSTALL="$SETUP_VP_INPUT_RUN_INSTALL"
export SETUP_VP_PACKAGE_MANAGER="$SETUP_VP_INPUT_PACKAGE_MANAGER"
export SETUP_VP_NODE_MANAGER="$SETUP_VP_INPUT_NODE_MANAGER"
export SETUP_VP_REGISTRY_URL="$SETUP_VP_INPUT_REGISTRY_URL"
export SETUP_VP_SCOPE="$SETUP_VP_INPUT_SCOPE"
export SETUP_VP_SETUP_REF="$SETUP_VP_INPUT_SETUP_REF"
# GitLab validates these inputs as a boolean and a fixed option list.
export SETUP_VP_SFW='$[[ inputs.sfw ]]'
if [ '$[[ inputs.cache-policy ]]' = 'pull' ]; then export SETUP_VP_CACHE_SAVE=false; fi
SETUP_VP_WORKING_DIRECTORY="$(cat <<'SETUP_VP_WORKING_DIRECTORY_EOF'
$[[ inputs.working-directory ]]
SETUP_VP_WORKING_DIRECTORY_EOF
)"
export SETUP_VP_WORKING_DIRECTORY
SETUP_VP_RUN_INSTALL="$(cat <<'SETUP_VP_RUN_INSTALL_EOF'
$[[ inputs.run-install ]]
SETUP_VP_RUN_INSTALL_EOF
)"
export SETUP_VP_RUN_INSTALL
SETUP_VP_SFW="$(cat <<'SETUP_VP_SFW_EOF'
$[[ inputs.sfw ]]
SETUP_VP_SFW_EOF
)"
export SETUP_VP_SFW
SETUP_VP_PACKAGE_MANAGER="$(cat <<'SETUP_VP_PACKAGE_MANAGER_EOF'
$[[ inputs.package-manager ]]
SETUP_VP_PACKAGE_MANAGER_EOF
)"
export SETUP_VP_PACKAGE_MANAGER
SETUP_VP_NODE_MANAGER="$(cat <<'SETUP_VP_NODE_MANAGER_EOF'
$[[ inputs.node-manager ]]
SETUP_VP_NODE_MANAGER_EOF
)"
export SETUP_VP_NODE_MANAGER
SETUP_VP_REGISTRY_URL="$(cat <<'SETUP_VP_REGISTRY_URL_EOF'
$[[ inputs.registry-url ]]
SETUP_VP_REGISTRY_URL_EOF
)"
export SETUP_VP_REGISTRY_URL
SETUP_VP_SCOPE="$(cat <<'SETUP_VP_SCOPE_EOF'
$[[ inputs.scope ]]
SETUP_VP_SCOPE_EOF
)"
export SETUP_VP_SCOPE
SETUP_VP_SETUP_REF="$(cat <<'SETUP_VP_SETUP_REF_EOF'
$[[ inputs.setup-ref ]]
SETUP_VP_SETUP_REF_EOF
)"
export SETUP_VP_SETUP_REF
- !reference [.setup-vp-bootstrap, before_script]

# Opt in to native GitLab persistence without replacing an existing job cache.
Expand Down
Loading
Loading