Fix Remote code execution (#24)

blablacar · Aug 19, 2024 · b9751a0 · b9751a0
1 parent 423964e
commit b9751a0
Show file tree

Hide file tree

Showing 2 changed files with 14 additions and 2 deletions.
diff --git a/.github/workflows/droid.yml b/.github/workflows/droid.yml
@@ -29,10 +29,17 @@ jobs:
         description: 'true'
 
     - if: ${{ steps.c-3po.outputs.is-hello }}
-      run: echo "${{ steps.c-3po.outputs.has-hello }}, it is you, it Is You!"
+      run: node ./test/assets/echo.js
+      env:
+        INPUTS_ARG1: "${{ steps.c-3po.outputs.has-hello }}"
+        INPUTS_ARG2: ", it is you, it Is You!"
 
     - if: ${{ steps.c-3po.outputs.is-chances && steps.c-3po.outputs.has-chances-survival }}
-      run: echo "R2 says the chances of survival are ${{ steps.c-3po.outputs.has-chances-survival }}... to one"
+      run: node ./test/assets/echo.js"
+      env:
+        INPUTS_ARG1: "R2 says the chances of survival are"
+        INPUTS_ARG2: "${{ steps.c-3po.outputs.has-chances-survival }}"
+        INPUTS_ARG3: "... to one"
 
     - if: ${{ steps.c-3po.outputs.is-chances && steps.c-3po.outputs.has-chances-win > 0 }}
       run: echo "We'll take the next chance, and the next."

diff --git a/test/assets/echo.js b/test/assets/echo.js
@@ -0,0 +1,5 @@
+const core = require('@actions/core')
+
+const args = [process.env.INPUTS_ARG1, process.env.INPUTS_ARG2, process.env.INPUTS_ARG3]
+
+core.info(args.join(' '))