Skip to content

fix(ci): replace the disabled ::set-output command with $GITHUB_OUTPUT #3094

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
boleklebovski wants to merge 1 commit into
base: main
Choose a base branch
from
+6 −6
Open

fix(ci): replace the disabled ::set-output command with $GITHUB_OUTPUT #3094

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
10 changes: 5 additions & 5 deletions .github/actions/analyze-comment/action.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -73,11 +73,11 @@ runs:
if: github.event_name != 'push'
shell: bash
run: |
body=$(cat .next/analyze/__bundle_analysis_comment.txt)
body="${body//'%'/'%25'}"
body="${body//$'\n'/'%0A'}"
body="${body//$'\r'/'%0D'}"
echo ::set-output name=body::$body
{

@aave-code-review aave-code-review Bot Aug 27, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Fixed heredoc delimiter allows output truncation or injection
medium · security
The step writes the bundle analysis body with the fixed delimiter BUNDLE_ANALYSIS_EOF. The GitHub output parser closes the value at the first line that equals the delimiter. Two failure modes exist. First, if .next/analyze/__bundle_analysis_comment.txt contains a line equal to BUNDLE_ANALYSIS_EOF, the parser truncates the body. Later file lines then become new output records for this step. A pull request that controls the analysis content can therefore replace the bot comment body. Second, if the file does not end with a newline, the last content line and the delimiter join into one line. The parser never finds the delimiter, and the output is empty or corrupt. Both cases break the output that this change repairs.
Why this severity: The analysis file is machine generated, so the trigger is not common. But a pull request can influence the content, and the result is a broken or forged step output.
How it is reached: An attacker opens a pull request. The attacker makes the bundle analysis text include a line with the value BUNDLE_ANALYSIS_EOF. The following lines become step output records and change the posted comment.

Suggested change
{
DELIMITER="BUNDLE_ANALYSIS_EOF_$(openssl rand -hex 16)"
{
echo "body<<${DELIMITER}"
cat .next/analyze/__bundle_analysis_comment.txt
echo
echo "${DELIMITER}"
} >> "$GITHUB_OUTPUT"

Review harness · reply here to accept or reject this finding

echo 'body<<BUNDLE_ANALYSIS_EOF'
cat .next/analyze/__bundle_analysis_comment.txt
echo 'BUNDLE_ANALYSIS_EOF'
} >> "$GITHUB_OUTPUT"

- name: Find Comment
uses: peter-evans/find-comment@1769778a0c5bd330272d749d12c036d65e70d39d # v2.0.0
Expand Down
2 changes: 1 addition & 1 deletion .github/workflows/test-deploy-fork.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -40,7 +40,7 @@ jobs:
shell: sh
id: get_pr_number
run: |
echo "::set-output name=pr_number::$(cat NUM | tr -dc '[:digit:]')"
echo "pr_number=$(cat NUM | tr -dc '[:digit:]')" >> "$GITHUB_OUTPUT"

- name: Link this CI run to PR
uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8.0.0
Expand Down