Brennan Kinney bdb770a0aa ci(fix): Do not trust user controlled input (#2337) ... The prepare workflow runs in an untrusted context already and thus should not have anything worthwhile to exploit. However care should still be taken to avoid interpolating expressions into shell scripts directly that is data a user can control the value of. Especially to avoid any maintainer referencing an existing workflow from copying a risky snippet unaware of different security contexts for workflows. In this case, as per Github Documentation and referenced issue comment, the PR title is user controllable data, which if directly interpolated into the shell script being run (as it previously was), allows for injecting commands to execute.		2021-12-21 21:46:09 +13:00
..
ISSUE_TEMPLATE	github(fix): Issues form - Use checkboxes for the experience question (#2297)	2021-11-14 00:07:54 +13:00
workflows	ci(fix): Do not trust user controlled input (#2337)	2021-12-21 21:46:09 +13:00
dependabot.yml	Added docker to dependabot.yml config (#2316)	2021-12-11 09:58:17 +01:00
pull_request_template.md	chore(docs): outsourcing environment vars to the documentation (#1948)	2021-05-11 22:15:34 +12:00