Please consider adding input safelisting about build-push-action

[franky47]

Indeed, it seems they fixed the issue, but partially. When invoking Node directly from a run clause, the environment is injectable, but not when running an action from a repository. See POC run for reference.

So this action is no longer vulnerable to injection, good to know. I will update my article accordingly.

[crazy-max]

@franky47 That's wrong each step in a job workflow is isolated in his own node process. Do you have a POC?

[franky47]

Steps may be isolated, but environment variables can be shared between steps within a job. My article (linked above) has a detailed explanation of the "issue" (which is considered a feature by GitHub). Unless something changed since I wrote the article, it is possible to inject arguments from a previous action to control another.

[crazy-max]

@franky47 In your article you said process.env.INPUT_FOO === 'bar' will be expanded to the whole job. But it's not. Let me know when you've got time to create a POC about this. See also https://docs.github.com/en/actions/reference/workflow-syntax-for-github-actions#env