diff options
| author | Hiroshi SHIBATA <hsbt@ruby-lang.org> | 2026-05-20 16:08:22 +0900 |
|---|---|---|
| committer | Hiroshi SHIBATA <hsbt@ruby-lang.org> | 2026-05-20 16:55:49 +0900 |
| commit | dafb92d91b1b1ac48ef633cabb478034137ea61e (patch) | |
| tree | 0b52e78c8f0a4dcb1c41df6e57d74fbbdba00971 /lib/bundler/templates/newgem/test | |
| parent | d8e250797e83adb1960047646f25adeca2a125b4 (diff) | |
Pass archname through env to avoid template injectionruby_3_4
zizmor flags `cd "${{ inputs.archname }}/"` inside `run:` blocks as
code injection via template expansion: GitHub Actions substitutes the
input value into the shell script verbatim, so a caller passing shell
metacharacters could execute arbitrary code.
Hoist `ARCHNAME: ${{ inputs.archname }}` to the job-level `env:` block
and reference it as `$ARCHNAME` in shell, matching the pattern already
used by tarball-windows.yml (see 942f45b2af).
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
Diffstat (limited to 'lib/bundler/templates/newgem/test')
0 files changed, 0 insertions, 0 deletions