fix(ci): avoid branch-name command injection in image dispatch#8513
Merged
andrewlock merged 1 commit intoApr 27, 2026
Merged
Conversation
andrewlock
force-pushed
the
codex/propose-fix-for-ci-command-injection-vulnerability
branch
from
April 23, 2026 16:39
ef13570 to
8380bed
Compare
andrewlock
added
area:builds
andrewlock
commented
Apr 23, 2026
andrewlock
left a comment
andrewlock
left a comment
Member
Author
There was a problem hiding this comment.
Oh, I can't approve, because it was "me" 😅
bouwkast
approved these changes
Apr 23, 2026
BenchmarksBenchmark execution time: 2026-04-23 17:46:54 Comparing candidate commit 8380bed in PR branch Found 0 performance improvements and 1 performance regressions! Performance is the same for 26 metrics, 0 unstable metrics, 57 known flaky benchmarks, 30 flaky benchmarks without significant changes.
|
Execution-Time Benchmarks Report ⏱️Execution-time results for samples comparing This PR (8513) and master. ✅ No regressions detected - check the details below Full Metrics ComparisonFakeDbCommand
HttpMessageHandler
Comparison explanationExecution-time benchmarks measure the whole time it takes to execute a program, and are intended to measure the one-off costs. Cases where the execution time results for the PR are worse than latest master results are highlighted in **red**. The following thresholds were used for comparing the execution times:
Note that these results are based on a single point-in-time result for each branch. For full results, see the dashboard. Graphs show the p99 interval based on the mean and StdDev of the test run, as well as the mean value of the run (shown as a diamond below the graph). Duration chartsFakeDbCommand (.NET Framework 4.8)gantt
title Execution time (ms) FakeDbCommand (.NET Framework 4.8)
dateFormat x
axisFormat %Q
todayMarker off
section Baseline
This PR (8513) - mean (75ms) : 69, 81
master - mean (73ms) : 69, 77
section Bailout
This PR (8513) - mean (80ms) : 75, 84
master - mean (80ms) : 76, 84
section CallTarget+Inlining+NGEN
This PR (8513) - mean (1,083ms) : 1018, 1148
master - mean (1,081ms) : 1038, 1124
FakeDbCommand (.NET Core 3.1)gantt
title Execution time (ms) FakeDbCommand (.NET Core 3.1)
dateFormat x
axisFormat %Q
todayMarker off
section Baseline
This PR (8513) - mean (117ms) : 111, 124
master - mean (117ms) : 111, 123
section Bailout
This PR (8513) - mean (117ms) : 111, 122
master - mean (118ms) : 112, 124
section CallTarget+Inlining+NGEN
This PR (8513) - mean (784ms) : 754, 814
master - mean (779ms) : 749, 810
FakeDbCommand (.NET 6)gantt
title Execution time (ms) FakeDbCommand (.NET 6)
dateFormat x
axisFormat %Q
todayMarker off
section Baseline
This PR (8513) - mean (101ms) : 96, 106
master - mean (102ms) : 98, 106
section Bailout
This PR (8513) - mean (100ms) : 98, 103
master - mean (106ms) : 99, 112
section CallTarget+Inlining+NGEN
This PR (8513) - mean (944ms) : 902, 985
master - mean (942ms) : 908, 976
FakeDbCommand (.NET 8)gantt
title Execution time (ms) FakeDbCommand (.NET 8)
dateFormat x
axisFormat %Q
todayMarker off
section Baseline
This PR (8513) - mean (104ms) : 97, 110
master - mean (101ms) : 97, 104
section Bailout
This PR (8513) - mean (104ms) : 99, 108
master - mean (101ms) : 99, 104
section CallTarget+Inlining+NGEN
This PR (8513) - mean (822ms) : 786, 857
master - mean (823ms) : 788, 858
HttpMessageHandler (.NET Framework 4.8)gantt
title Execution time (ms) HttpMessageHandler (.NET Framework 4.8)
dateFormat x
axisFormat %Q
todayMarker off
section Baseline
This PR (8513) - mean (205ms) : 196, 213
master - mean (206ms) : 196, 216
section Bailout
This PR (8513) - mean (210ms) : 202, 219
master - mean (210ms) : 201, 219
section CallTarget+Inlining+NGEN
This PR (8513) - mean (1,210ms) : 1155, 1264
master - mean (1,211ms) : 1144, 1277
HttpMessageHandler (.NET Core 3.1)gantt
title Execution time (ms) HttpMessageHandler (.NET Core 3.1)
dateFormat x
axisFormat %Q
todayMarker off
section Baseline
This PR (8513) - mean (289ms) : 278, 301
master - mean (294ms) : 281, 308
section Bailout
This PR (8513) - mean (289ms) : 278, 300
master - mean (296ms) : 281, 310
section CallTarget+Inlining+NGEN
This PR (8513) - mean (949ms) : 922, 976
master - mean (962ms) : 927, 997
HttpMessageHandler (.NET 6)gantt
title Execution time (ms) HttpMessageHandler (.NET 6)
dateFormat x
axisFormat %Q
todayMarker off
section Baseline
This PR (8513) - mean (283ms) : 272, 294
master - mean (285ms) : 277, 293
section Bailout
This PR (8513) - mean (282ms) : 274, 290
master - mean (287ms) : 274, 300
section CallTarget+Inlining+NGEN
This PR (8513) - mean (1,152ms) : 1110, 1194
master - mean (1,155ms) : 1116, 1194
HttpMessageHandler (.NET 8)gantt
title Execution time (ms) HttpMessageHandler (.NET 8)
dateFormat x
axisFormat %Q
todayMarker off
section Baseline
This PR (8513) - mean (284ms) : 270, 297
master - mean (285ms) : 275, 294
section Bailout
This PR (8513) - mean (284ms) : 273, 294
master - mean (285ms) : 276, 293
section CallTarget+Inlining+NGEN
This PR (8513) - mean (1,050ms) : 985, 1115
master - mean (1,048ms) : 974, 1121
|
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
andrewlock
commented
Apr 24, 2026
| if echo "$LABELS" | grep -q "docker_image_artifacts"; then | ||
| BRANCH_NAME="$(System.PullRequest.SourceBranch)" | ||
| BRANCH_NAME="$PR_SOURCE_BRANCH" | ||
| BRANCH_NAME="${BRANCH_NAME#refs/heads/}" |
Member
Author
There was a problem hiding this comment.
FWIW, I'm pretty sure this line is not necessary, because this variable doesn't include the refs/heads/ prefix, but whatever
andrewlock
deleted the
codex/propose-fix-for-ci-command-injection-vulnerability
branch
April 27, 2026 10:56
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Motivation
Description
PR_SOURCE_BRANCHinstead of embedding$(System.PullRequest.SourceBranch)directly into the script, and normalize it by stripping therefs/heads/prefix withBRANCH_NAME="${BRANCH_NAME#refs/heads/}"before use.REFassignment (REF="$(Build.SourceBranch)") to avoid accidental word-splitting during parsing.PR_SOURCE_BRANCHvia the jobenvso the pipeline consumes an env var rather than untrusted inline interpolation.�${{ github.event.inputs.branch_name }}directly in the script and instead pass the input through a stepenvvariableBRANCH_NAME_INPUTand then sanitize/normalize that variable in-shell before generating theimage_tag.Testing
Codex Task