From d97883bcc56af59c8670fef5ff44b6c29a014b8d Mon Sep 17 00:00:00 2001 From: Daniel Hast Date: Mon, 1 Dec 2025 08:05:02 -0500 Subject: [PATCH] ci: use --sandbox for dynamically generated sed scripts sed scripts are capable of doing file I/O and executing arbitrary commands. The `--sandbox` option prevents this by rejecting sed commands with such capabilities; it's good practice to use this whenever the sed script is dynamically generated (e.g. if it involves a variable expansion). Also fixed an error in one sed script where `.*` had been placed outside of the quoted string (and would therefore be subject to shell globbing), presumably due to single-quotes having been changed to double-quotes at some point in the past. Signed-off-by: Daniel Hast (cherry picked from commit 3f4af378f4372e7188d1092d348501e870f75f88) Signed-off-by: Paul Holzinger --- .github/workflows/dev-bump.yml | 4 ++-- .github/workflows/first_contrib_cert_generator.yml | 6 +++--- .github/workflows/machine-os-pr.yml | 4 ++-- .github/workflows/update-podmanio.yml | 2 +- 4 files changed, 8 insertions(+), 8 deletions(-) diff --git a/.github/workflows/dev-bump.yml b/.github/workflows/dev-bump.yml index 4f5af732b1..70c217fbee 100644 --- a/.github/workflows/dev-bump.yml +++ b/.github/workflows/dev-bump.yml @@ -27,7 +27,7 @@ jobs: echo "::notice:: bumping z up to $devbump" fi - sed -i "s/const RawVersion = ".*"/const RawVersion = \"${devbump}\"/g" version/rawversion/version.go + sed --sandbox -i -e "s/const RawVersion = \".*\"/const RawVersion = \"${devbump}\"/g" version/rawversion/version.go echo "devbump=$devbump" >> $GITHUB_OUTPUT - name: Push @@ -110,7 +110,7 @@ jobs: devbump="$(IFS=. ; echo "${arr[*]}")-dev" echo "::notice:: Bumping main to: $devbump" - sed -i "s/const RawVersion = \".*\"/const RawVersion = \"$devbump\"/g" version/rawversion/version.go + sed --sandbox -i -e "s/const RawVersion = \".*\"/const RawVersion = \"${devbump}\"/g" version/rawversion/version.go echo "devbump=$devbump" >> $GITHUB_OUTPUT - name: Push diff --git a/.github/workflows/first_contrib_cert_generator.yml b/.github/workflows/first_contrib_cert_generator.yml index 411d987b6e..4164797687 100644 --- a/.github/workflows/first_contrib_cert_generator.yml +++ b/.github/workflows/first_contrib_cert_generator.yml @@ -70,9 +70,9 @@ jobs: PR_NUMBER="${{ github.event.inputs.pr_number || github.event.pull_request.number }}" MERGE_DATE=$(date -u +"%B %d, %Y") - sed -i "/id=\"contributorName\"/s/value=\"[^\"]*\"/value=\"${CONTRIBUTOR_NAME}\"/" ${HTML_FILE} || { echo "ERROR: Failed to update contributor name."; exit 1; } - sed -i "/id=\"prNumber\"/s/value=\"[^\"]*\"/value=\"#${PR_NUMBER}\"/" ${HTML_FILE} || { echo "ERROR: Failed to update PR number."; exit 1; } - sed -i "/id=\"mergeDate\"/s/value=\"[^\"]*\"/value=\"${MERGE_DATE}\"/" ${HTML_FILE} || { echo "ERROR: Failed to update merge date."; exit 1; } + sed --sandbox -i -e "/id=\"contributorName\"/s/value=\"[^\"]*\"/value=\"${CONTRIBUTOR_NAME}\"/" ${HTML_FILE} || { echo "ERROR: Failed to update contributor name."; exit 1; } + sed --sandbox -i -e "/id=\"prNumber\"/s/value=\"[^\"]*\"/value=\"#${PR_NUMBER}\"/" ${HTML_FILE} || { echo "ERROR: Failed to update PR number."; exit 1; } + sed --sandbox -i -e "/id=\"mergeDate\"/s/value=\"[^\"]*\"/value=\"${MERGE_DATE}\"/" ${HTML_FILE} || { echo "ERROR: Failed to update merge date."; exit 1; } # Step 4: Setup Node.js environment - name: Setup Node.js diff --git a/.github/workflows/machine-os-pr.yml b/.github/workflows/machine-os-pr.yml index b6d065d2a9..6e03a27eeb 100644 --- a/.github/workflows/machine-os-pr.yml +++ b/.github/workflows/machine-os-pr.yml @@ -79,8 +79,8 @@ jobs: VERS: ${{steps.getversion.outputs.version}} run: | update=$(printf 's/export PODMAN_VERSION=".*"/export PODMAN_VERSION="%s"/g\n' "$VERS") - sed -i "$update" podman-rpm-info-vars.sh - sed -i 's/export PODMAN_PR_NUM=".*"/export PODMAN_PR_NUM="${{github.event.number}}"/g' podman-rpm-info-vars.sh + sed --sandbox -i -e "$update" podman-rpm-info-vars.sh + sed --sandbox -i -e "s/export PODMAN_PR_NUM=\".*\"/export PODMAN_PR_NUM=\"${{github.event.number}}\"/g" podman-rpm-info-vars.sh echo "Updated file:" cat podman-rpm-info-vars.sh diff --git a/.github/workflows/update-podmanio.yml b/.github/workflows/update-podmanio.yml index 5dcbf57874..6fb7085b47 100644 --- a/.github/workflows/update-podmanio.yml +++ b/.github/workflows/update-podmanio.yml @@ -100,7 +100,7 @@ jobs: steps.checkpr.outputs.prexists == 'false' run: | # Replace the version in static/data/global.ts file - sed -i "s/export const LATEST_VERSION = '.*';/export const LATEST_VERSION = '${{ steps.getversion.outputs.version }}';/g" static/data/global.ts + sed --sandbox -i -e "s/export const LATEST_VERSION = '.*';/export const LATEST_VERSION = '${{ steps.getversion.outputs.version }}';/g" static/data/global.ts echo "Updated file:" cat static/data/global.ts