Maven workflow vulnerability: unsafe interpolation of github.ref_name into shell API URL

[gemshrine]

Symptom

The Maven notification workflow interpolates github.ref_name directly into the gh api URL used to find previous runs.

Steps to reproduce

1. Start .github/workflows/mvn.yml for a branch or tag containing shell metacharacters, such as test$(touch /tmp/marker).
2. Inspect the previous step's gh api command.

Actual result

The expression is expanded before Bash parses the command. Command substitution in the resulting double-quoted URL can run arbitrary commands in the workflow.

Expected result

Use an environment variable or a request parameter for the ref and validate it before constructing the API query.

Evidence

.github/workflows/mvn.yml:86 contains branch=${{ github.ref_name }} inside a shell command.

[h1alexbel]

@gemshrine can be closed?

[0crat]

@gemshrine Thanks for reporting a new bug! You've earned +12 points. By reporting bugs, you help our project improve its quality. If you find anything else in the repository that doesn't look as good as you might expect, do not hesitate to report it. Your running score is +3464; don't forget to check your Zerocracy account too).