Skip to content

Commit c8ed110

Browse files
committed
fix(review): randomize heredoc delimiter to prevent output injection
1 parent 42df4d8 commit c8ed110

1 file changed

Lines changed: 3 additions & 2 deletions

File tree

.github/workflows/claude-pr-review.yml

Lines changed: 3 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -75,10 +75,11 @@ jobs:
7575
end
7676
')
7777
78+
DELIMITER="REVIEW_CONTEXT_$(openssl rand -hex 16)"
7879
{
79-
echo "threads<<REVIEW_CONTEXT_HEREDOC"
80+
echo "threads<<${DELIMITER}"
8081
echo "$THREADS"
81-
echo "REVIEW_CONTEXT_HEREDOC"
82+
echo "${DELIMITER}"
8283
} >> $GITHUB_OUTPUT
8384
env:
8485
GH_TOKEN: ${{ github.token }}

0 commit comments

Comments
 (0)