From 8e5c9f28f17d25c177cdb9c145f3b28862076d37 Mon Sep 17 00:00:00 2001
From: Shubham Chaturvedi <scchatur@amazon.com>
Date: Wed, 15 Jul 2026 15:29:14 -0700
Subject: [PATCH] fix(ci): Prevent script injection in GitHub Actions workflows

Bind untrusted GitHub context values to intermediate environment
variables instead of interpolating them directly into inline run
scripts. User-controlled inputs (workflow_dispatch inputs and
pull_request event fields) spliced into shell scripts allow command
injection on the runner.

- go-release.yml: move github.event.inputs.project-name/version into
  env vars in the release-dir, run-release, and print-diff steps; quote
  all shell references
- smithy-diff.yml: move github.event.pull_request.user.login,
  github.actor, and github.repository into env vars in the comment step

Addresses AWS AppSec ACAT finding (Script Injection in GitHub Actions
workflows).

sim: https://t.corp.amazon.com/V2263272257
---
 .github/workflows/go-release.yml  | 19 +++++++++++++------
 .github/workflows/smithy-diff.yml |  9 ++++++---
 2 files changed, 19 insertions(+), 9 deletions(-)

diff --git a/.github/workflows/go-release.yml b/.github/workflows/go-release.yml
index 043eebab3..1b53be407 100644
--- a/.github/workflows/go-release.yml
+++ b/.github/workflows/go-release.yml
@@ -64,9 +64,12 @@ jobs:
 
       - name: Get release directory name
         id: release-dir
+        env:
+          PROJECT_NAME: ${{ github.event.inputs.project-name }}
+          VERSION: ${{ github.event.inputs.version }}
         run: |
           chmod +x mpl/scripts/go-release-automation.sh
-          RELEASE_DIR_NAME=$(mpl/scripts/go-release-automation.sh get_release_dir_name "${{ github.event.inputs.project-name }}" "${{ github.event.inputs.version }}")
+          RELEASE_DIR_NAME=$(mpl/scripts/go-release-automation.sh get_release_dir_name "$PROJECT_NAME" "$VERSION")
           echo "releaseDirName=$RELEASE_DIR_NAME" >> $GITHUB_OUTPUT
 
       - name: Generate a changelog
@@ -76,13 +79,17 @@ jobs:
           args: --bump -u --prepend releases/go/${{ steps.release-dir.outputs.releaseDirName }}/CHANGELOG.md
 
       - name: Run Go release automation script
+        env:
+          PROJECT_NAME: ${{ github.event.inputs.project-name }}
+          VERSION: ${{ github.event.inputs.version }}
         run: |
           chmod +x mpl/scripts/go-release-automation.sh
-          mpl/scripts/go-release-automation.sh run_release_script ${{ github.event.inputs.project-name }} ${{ github.event.inputs.version }}
+          mpl/scripts/go-release-automation.sh run_release_script "$PROJECT_NAME" "$VERSION"
 
       - name: print diff between development and release directory
+        env:
+          RELEASE_DIR_NAME: ${{ steps.release-dir.outputs.releaseDirName }}
+          PROJECT_NAME: ${{ github.event.inputs.project-name }}
         run: |
-          RELEASE_DIR_NAME="${{ steps.release-dir.outputs.releaseDirName }}"
-          PROJECT_NAME="${{ github.event.inputs.project-name }}"
-          DIFF_FILES=$(diff -qr $PROJECT_NAME/runtimes/go/ImplementationFromDafny-go releases/go/$RELEASE_DIR_NAME || true)
-          echo $DIFF_FILES
+          DIFF_FILES=$(diff -qr "$PROJECT_NAME/runtimes/go/ImplementationFromDafny-go" "releases/go/$RELEASE_DIR_NAME" || true)
+          echo "$DIFF_FILES"
diff --git a/.github/workflows/smithy-diff.yml b/.github/workflows/smithy-diff.yml
index fbd6525d6..0f4e7c620 100644
--- a/.github/workflows/smithy-diff.yml
+++ b/.github/workflows/smithy-diff.yml
@@ -33,9 +33,12 @@ jobs:
           PR_NUMBER: ${{ github.event.pull_request.number }}
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
           FILES: ${{ steps.file-changes.outputs.FILES }}
+          PR_USER: ${{ github.event.pull_request.user.login }}
+          ACTOR: ${{ github.actor }}
+          REPO: ${{ github.repository }}
         if: ${{env.FILES != ''}}
         run: |
           # TODO: If https://github.com/smithy-lang/smithy-dafny/issues/491 is resolved, remove comment about this issue.
-          COMMENT="@${{github.event.pull_request.user.login}} and @${{github.actor}}, I noticed you are updating the smithy model files.\nDoes this update need new or updated javadoc trait documentation?\n Are you adding constraints inside list, map or union? Do you know about this issue: https://github.com/smithy-lang/smithy-dafny/issues/491?"
-          COMMENT_URL="https://api.github.com/repos/${{ github.repository }}/issues/${PR_NUMBER}/comments"
-          curl -s -H "Authorization: token ${GITHUB_TOKEN}" -X POST $COMMENT_URL -d "{\"body\":\"$COMMENT\"}"
+          COMMENT="@${PR_USER} and @${ACTOR}, I noticed you are updating the smithy model files.\nDoes this update need new or updated javadoc trait documentation?\n Are you adding constraints inside list, map or union? Do you know about this issue: https://github.com/smithy-lang/smithy-dafny/issues/491?"
+          COMMENT_URL="https://api.github.com/repos/${REPO}/issues/${PR_NUMBER}/comments"
+          curl -s -H "Authorization: token ${GITHUB_TOKEN}" -X POST "$COMMENT_URL" -d "{\"body\":\"$COMMENT\"}"