Eliminated potential for malicious code injection

.github/workflows/sync-chatgpt.js-changes-to-chrome-starter.yml

@@ -42,13 +42,19 @@ jobs:
  cd "${{ github.workspace }}/KudoAI/chatgpt.js-chrome-starter/extension"
  sed -i -E "s/\"version\": \"([0-9]+\.[0-9]+\.[0-9]+)\.*([0-9]*)\"/\"version\": \"$(date +'%Y.%-m.%-d')\"/g" manifest.json
 
+ - name: Escape backticks in commit msg
+ env:
+ COMMIT_MSG: ${{ github.event.head_commit.message }}
+ run: |
+ echo "ESCAPED_MSG=$(echo "$COMMIT_MSG" | sed 's/`/\`/g')" >> $GITHUB_ENV
+
  - name: Push changes to KudoAI/chatgpt.js
  run: |
  cd ${{ github.workspace }}/KudoAI/chatgpt.js
  git config --global user.name "kudo-sync-bot"
  git config --global user.email "auto-sync@kudoai.com"
  git add .
- git commit -n -m "$(echo '${{ github.event.head_commit.message }}' | sed 's/`/\`/g') ↞ [auto-sync from \`KudoAI/chatgpt.js\`]" || true
+ git commit -n -m "$ESCAPED_MSG ↞ [auto-sync from \`KudoAI/chatgpt.js\`]" || true
  git push
 
  - name: Push changes to KudoAI/chatgpt.js-chrome-starter
@@ -57,5 +63,5 @@ jobs:
  git config --global user.name "kudo-sync-bot"
  git config --global user.email "auto-sync@kudoai.com"
  git add .
- git commit -n -m "$(echo '${{ github.event.head_commit.message }}' | sed 's/`/\`/g')↞ [auto-sync from \`KudoAI/chatgpt.js\`]" || true
+ git commit -n -m "$ESCAPED_MSG↞ [auto-sync from \`KudoAI/chatgpt.js\`]" || true
  git push

.github/workflows/sync-chrome-starter-changes.yml

@@ -31,11 +31,17 @@ jobs:
  "${{ github.workspace }}/KudoAI/chatgpt.js/starters/chrome/" \
  "${{ github.workspace }}/KudoAI/chatgpt.js-chrome-starter/"
 
+ - name: Escape backticks in commit msg
+ env:
+ COMMIT_MSG: ${{ github.event.head_commit.message }}
+ run: |
+ echo "ESCAPED_MSG=$(echo "$COMMIT_MSG" | sed 's/`/\`/g')" >> $GITHUB_ENV
+
  - name: Push changes to KudoAI/chatgpt.js-chrome-starter
  run: |
  cd ${{ github.workspace }}/KudoAI/chatgpt.js-chrome-starter
  git config --global user.name "kudo-sync-bot"
  git config --global user.email "auto-sync@kudoai.com"
  git add .
- git commit -n -m "$(echo '${{ github.event.head_commit.message }}' | sed 's/`/\`/g') ↞ [auto-sync from \`KudoAI/chatgpt.js\`]" || true
+ git commit -n -m "$ESCAPED_MSG ↞ [auto-sync from \`KudoAI/chatgpt.js\`]" || true
  git push

.github/workflows/sync-en-readme-changes.yml

@@ -32,11 +32,17 @@ jobs:
  # Store sync src for commit msg in next step
  echo "sync_src=$sync_src" >> $GITHUB_OUTPUT
 
+ - name: Escape backticks in commit msg
+ env:
+ COMMIT_MSG: ${{ github.event.head_commit.message }}
+ run: |
+ echo "ESCAPED_MSG=$(echo "$COMMIT_MSG" | sed 's/`/\`/g')" >> $GITHUB_ENV
+
  - name: Push changes to KudoAI/chatgpt.js
  run: |
  cd ${{ github.workspace }}/KudoAI/chatgpt.js
  git config --global user.name "kudo-sync-bot"
  git config --global user.email "auto-sync@kudoai.com"
  git add .
- git commit -n -m "$(echo '${{ github.event.head_commit.message }}' | sed 's/`/\`/g') ↞ [auto-sync from \`${{ steps.sync_readmes.outputs.sync_src }}\`]" || true
+ git commit -n -m "$ESCAPED_MSG ↞ [auto-sync from \`${{ steps.sync_readmes.outputs.sync_src }}\`]" || true
  git push

.github/workflows/sync-greasemonkey-starter-changes.yml

@@ -31,11 +31,17 @@ jobs:
  "${{ github.workspace }}/KudoAI/chatgpt.js/starters/greasemonkey/" \
  "${{ github.workspace }}/KudoAI/chatgpt.js-greasemonkey-starter/"
 
+ - name: Escape backticks in commit msg
+ env:
+ COMMIT_MSG: ${{ github.event.head_commit.message }}
+ run: |
+ echo "ESCAPED_MSG=$(echo "$COMMIT_MSG" | sed 's/`/\`/g')" >> $GITHUB_ENV
+
  - name: Push changes to KudoAI/chatgpt.js-greasemonkey-starter
  run: |
  cd ${{ github.workspace }}/KudoAI/chatgpt.js-greasemonkey-starter
  git config --global user.name "kudo-sync-bot"
  git config --global user.email "auto-sync@kudoai.com"
  git add .
- git commit -n -m "$(echo '${{ github.event.head_commit.message }}' | sed 's/`/\`/g') ↞ [auto-sync from \`KudoAI/chatgpt.js\`]" || true
+ git commit -n -m "$ESCAPED_MSG ↞ [auto-sync from \`KudoAI/chatgpt.js\`]" || true
  git push