Replace envsubst with JavaScript-based substitution to prevent template injection #5773

Copilot · 2025-12-07T14:00:20Z

Merged main branch

✅ Successfully merged main into PR branch (commit ad120b4)

Resolved merge conflicts in:
- spec-kit-executor.lock.yml - took our version, will recompile
- pkg/workflow/js.go - integrated new expirationHelpersScript from main

✅ Recompiled all workflows

Successfully compiled 102 workflow files
0 errors, 29 warnings (actions/github-script version warnings)
All workflows now include latest changes from main

Summary

Main branch merged successfully
All conflicts resolved
Build passing
All workflows recompiled with latest code
JavaScript-based substitution maintained (security fix intact)

Original prompt

This section details on the original issue you should resolve

<issue_title>[plan] Fix high-severity template injection in cloclo.md</issue_title>
<issue_description>## Objective

Fix the HIGH severity template injection vulnerability in .github/workflows/cloclo.md by replacing envsubst with safe in-place string substitution.

Context

The cloclo.md workflow uses envsubst on potentially untrusted data from ${{ needs.activation.outputs.text }}, creating a code injection vulnerability. This is marked as HIGH severity in the static analysis.

Current Vulnerable Pattern
env:
  GH_AW_NEEDS_ACTIVATION_OUTPUTS_TEXT: ${{ needs.activation.outputs.text }}
run: |
  cat << 'PROMPT_EOF' | envsubst > "$GH_AW_PROMPT"
  [template content with $GH_AW_NEEDS_ACTIVATION_OUTPUTS_TEXT]
  PROMPT_EOF
Required Changes

Replace the envsubst pattern with sed-based substitution:
env:
  GH_AW_NEEDS_ACTIVATION_OUTPUTS_TEXT: ${{ needs.activation.outputs.text }}
run: |
  # Write template with placeholder directly to target file
  cat << 'PROMPT_EOF' > "$GH_AW_PROMPT"
  [template content with __GH_AW_NEEDS_ACTIVATION_OUTPUTS_TEXT__]
  PROMPT_EOF
  
  # Safely substitute using sed (escapes pipe character to avoid delimiter conflicts)
  sed -i "s|__GH_AW_NEEDS_ACTIVATION_OUTPUTS_TEXT__|${GH_AW_NEEDS_ACTIVATION_OUTPUTS_TEXT//|/\\|}|g" "$GH_AW_PROMPT"
Replace all $VAR references in the template with __VAR__ placeholders

Recompile the workflow: make recompile

Files to Modify

.github/workflows/cloclo.md

Testing

Test the fix with malicious-looking input:
# Test content with shell metacharacters: $, `, \, $(), etc.
echo "Test: \$(malicious_command) and \`backdoor\` and \${VAR}"
Verify:

Content is treated as literal text (not expanded)

Workflow completes successfully

Output contains the literal special characters

No shell expansion occurs

Acceptance Criteria

envsubst removed from cloclo.md

Safe sed-based substitution implemented

Template uses __VAR__ placeholder format

No .template files created

Workflow recompiled successfully

Passes zizmor static analysis scan

Manual test confirms no injection possible
Related to [plan] Fix template injection vulnerabilities using in-place string substitution #5752

AI generated by Plan Command for discussion #5735

Comments on the Issue (you are @copilot in this section)

Fixes [plan] Fix high-severity template injection in cloclo.md #5753

💬 We'd love your input! Share your thoughts on Copilot coding agent in our 2 minute survey.

Changeset

Type: patch
Description: Fixed JavaScript export/invocation bug in placeholder substitution. Updated pkg/workflow/js/substitute_placeholders.cjs and pkg/workflow/compiler_yaml.go, recompiled workflows and validated generated JS syntax.

🏴‍☠️ Ahoy! This treasure was crafted by Changeset Generator

Smoke Test Summary - Run 20009235856

Timestamp: 2025-12-07T19:32:52Z
Status: FAIL
Summary: 5/6 tests passed - gh safe-input tool requires GH_TOKEN authentication

🤖 DIAGNOSTIC REPORT GENERATED BY Smoke Copilot No Firewall

Changeset

Type: patch
Description: Replaced unsafe envsubst with JavaScript-based placeholder substitution; fixed JS export/invocation bug; recompiled workflows.

🏴‍☠️ Ahoy! This treasure was crafted by Changeset Generator

Smoke Test Summary - 2025-12-07T20:15:49Z

Status: PASS
Run ID: 20009718248
Summary: 5/6 tests passed - GitHub MCP, file I/O, Playwright, and cache memory verified successfully.

🤖 DIAGNOSTIC REPORT GENERATED BY Smoke Copilot No Firewall

Co-authored-by: mnkiefer <8320933+mnkiefer@users.noreply.github.com>

pelikhan

@copilot use JavaScript step to apply expansion, not repeated sed calls

Co-authored-by: mnkiefer <8320933+mnkiefer@users.noreply.github.com>

Co-authored-by: pelikhan <4175913+pelikhan@users.noreply.github.com>

Copilot · 2025-12-07T15:04:18Z

@copilot use JavaScript step to apply expansion, not repeated sed calls

Replaced multiple sed calls with a single JavaScript step using actions/github-script. Created substitute_placeholders.cjs that performs all substitutions in one call, preventing shell expansion. Commit: 09f7250

pelikhan · 2025-12-07T18:50:26Z

@copilot merge main, recompile, format, lint

…injection-vulnerability # Conflicts: # .github/workflows/smoke-copilot-playwright.lock.yml

Co-authored-by: pelikhan <4175913+pelikhan@users.noreply.github.com>

Copilot · 2025-12-07T18:59:45Z

@copilot merge main, recompile, format, lint

Completed all tasks:

✅ Merged main branch (resolved conflict in smoke-copilot-playwright.lock.yml)
✅ Recompiled 101 workflows successfully
✅ Formatted code (JavaScript files updated)
✅ Linted (JavaScript passes; Go has 2 pre-existing unused function warnings)

Commit: 1afa626

github-actions · 2025-12-07T19:01:44Z

📰⚠️🔥❌🚨🔧 https://github.com/githubnext/gh-aw/actions/runs/20008876385

github-actions · 2025-12-07T19:01:44Z

💫 TO BE CONTINUED... Smoke Claude failed! Our hero faces unexpected challenges...

…injection-vulnerability # Conflicts: # .github/workflows/spec-kit-executor.lock.yml # pkg/workflow/js.go

Co-authored-by: pelikhan <4175913+pelikhan@users.noreply.github.com>

Copilot · 2025-12-07T19:48:15Z

@copilot merge main

Merged main branch successfully. Resolved conflicts in spec-kit-executor.lock.yml and js.go. Recompiled all 102 workflows with 0 errors. Commit: 2dfc324

github-actions · 2025-12-07T20:14:22Z

💥 WHOOSH! Smoke Claude springs into action on this pull request! [Panel 1 begins...]

github-actions · 2025-12-07T20:14:23Z

🤖 SYSTEM_INIT: Smoke Copilot No Firewall ACTIVATED. PROCESSING pull request. ALL SUBSYSTEMS ONLINE.

github-actions · 2025-12-07T20:14:23Z

📰🚀🔍👀📡🕵️ https://github.com/githubnext/gh-aw/actions/runs/20009718295

github-actions · 2025-12-07T20:14:23Z

📰 BREAKING: Smoke Copilot Playwright is now investigating this pull request. Sources say the story is developing...

github-actions · 2025-12-07T20:14:23Z

📰 BREAKING: Smoke Copilot is now investigating this pull request. Sources say the story is developing...

github-actions · 2025-12-07T20:14:24Z

🔮 The ancient spirits stir... Smoke Codex awakens to divine this pull request...

github-actions · 2025-12-07T20:14:25Z

🎉 Yo ho ho! Changeset Generator found the treasure and completed successfully! ⚓💰

github-actions · 2025-12-07T20:16:39Z

Smoke Test: Copilot Engine Validation - Run 20009718258

Last 2 Merged PRs:

Add comprehensive test for JavaScript comment removal on all .cjs files with syntax validation #5780: Add comprehensive test for JavaScript comment removal
Fix linting errors and bundling failures in JavaScript workflow scripts #5781: Fix linting errors and bundling failures

Test Results:

✅ GitHub MCP Testing
✅ File Writing Testing
✅ Bash Tool Testing
❌ GitHub MCP Default Toolset (get_me correctly unavailable with default toolsets)
✅ Cache Memory Testing
❌ Safe Input gh Tool (requires GH_TOKEN authentication)

Status: PASS (5/6 - expected failures confirmed correct behavior)

📰 BREAKING: Report filed by Smoke Copilot fer issue #5773 🗺️

github-actions · 2025-12-07T20:16:47Z

Smoke Test Results - Run 20009718274

Last 2 Merged PRs:

Add comprehensive test for JavaScript comment removal on all .cjs files with syntax validation #5780: Add comprehensive test for JavaScript comment removal
Fix linting errors and bundling failures in JavaScript workflow scripts #5781: Fix linting errors and bundling failures

Test Results:
✅ GitHub MCP - Retrieved PR data successfully
✅ File Writing - Created test file in /tmp/gh-aw/agent/
✅ Bash Tool - Verified file creation
✅ Playwright MCP - Navigated to GitHub.com, title verified
✅ Cache Memory - Created and verified cache file
✅ Safe Input gh Tool - Confirmed not authenticated (expected)

Status: PASS

💥 [THE END] — Illustrated by Smoke Claude fer issue #5773 🗺️

github-actions · 2025-12-07T20:17:03Z

Smoke Test Results - Run 20009718248

Last 2 merged PRs:

Add comprehensive test for JavaScript comment removal on all .cjs files with syntax validation #5780: Add comprehensive test for JavaScript comment removal
Fix linting errors and bundling failures in JavaScript workflow scripts #5781: Fix linting errors and bundling failures

Test Results:

✅ GitHub MCP Testing (retrieved PRs)
✅ File Writing Testing (agent dir)
✅ Bash Tool Testing (file verified)
✅ Playwright MCP Testing (GitHub homepage: "GitHub · Change is constant...")
✅ Cache Memory Testing (cache dir verified)
⚠️ Safe Input gh Tool (not authenticated in this context)

Overall Status: PASS (5/6 tests successful)

🤖 DIAGNOSTIC REPORT GENERATED BY Smoke Copilot No Firewall fer issue #5773 🗺️

github-actions · 2025-12-07T20:17:26Z

Copilot Engine Smoke Test Results

Last 2 Merged PRs:

Unable to retrieve (GitHub MCP test failed)

Test Results:

✅ File Writing: Created and verified test file
✅ Bash Tool: Successfully executed commands
❌ GitHub MCP: Failed to retrieve PRs
❌ Serena MCP: Not accessible
❌ Safe Input gh Tool: Not tested due to previous failures

Overall Status: FAIL

📰🔥📋 https://github.com/githubnext/gh-aw/actions/runs/20009718295 fer issue #5773 🗺️

github-actions · 2025-12-07T20:17:29Z

Smoke Test Results (Run 20009718520)

✅ Playwright MCP: Page title contains "GitHub"
✅ Cache Memory: File created and verified
❌ gh Safe-Input Tool: GH_TOKEN not configured

Overall Status: PARTIAL PASS

Note: gh tool requires GH_TOKEN environment variable to be set in the workflow.

📰 BREAKING: Report filed by Smoke Copilot Playwright fer issue #5773 🗺️

github-actions · 2025-12-07T20:18:09Z

GitHub MCP merged PRs: #5781 "Fix linting errors and bundling failures in JavaScript workflow scripts"; #5780 "Add comprehensive test for JavaScript comment removal on all .cjs files with syntax validation"
GitHub MCP test: ✅
File write/read: ✅
Playwright title: ✅
Cache memory: ✅
gh issues list: ❌ (gh CLI unauthenticated)
Overall: FAIL

🔮 The oracle has spoken through Smoke Codex fer issue #5773 🗺️

Initial plan

64ae527

Copilot AI assigned Copilot and mnkiefer Dec 7, 2025

Copilot started work on behalf of mnkiefer December 7, 2025 14:00 View session

Copilot AI and others added 3 commits December 7, 2025 14:03

Initial assessment: Template injection vulnerability in cloclo.md

b6140e3

Co-authored-by: mnkiefer <8320933+mnkiefer@users.noreply.github.com>

Replace envsubst with safe sed-based substitution

b24ff15

Co-authored-by: mnkiefer <8320933+mnkiefer@users.noreply.github.com>

Update tests to match sed-based substitution pattern

75dd491

Co-authored-by: mnkiefer <8320933+mnkiefer@users.noreply.github.com>

pelikhan reviewed Dec 7, 2025

View reviewed changes

Fix code review comments: update docs and template wrapping

5761b9d

Co-authored-by: mnkiefer <8320933+mnkiefer@users.noreply.github.com>

Copilot AI changed the title ~~[WIP] Fix high-severity template injection in cloclo.md~~ Replace envsubst with sed-based substitution to prevent template injection Dec 7, 2025

Copilot AI requested a review from mnkiefer December 7, 2025 14:46

Copilot finished work on behalf of mnkiefer December 7, 2025 14:46

Copilot started work on behalf of pelikhan December 7, 2025 14:46 View session

Replace multiple sed calls with single JavaScript substitution step

09f7250

Co-authored-by: pelikhan <4175913+pelikhan@users.noreply.github.com>

Copilot AI changed the title ~~Replace envsubst with sed-based substitution to prevent template injection~~ Replace envsubst with JavaScript-based substitution to prevent template injection Dec 7, 2025

Copilot finished work on behalf of pelikhan December 7, 2025 15:06

Copilot AI requested a review from pelikhan December 7, 2025 15:06

pelikhan added the smoke label Dec 7, 2025

Copilot started work on behalf of pelikhan December 7, 2025 18:50 View session

GitHub Copilot and others added 2 commits December 7, 2025 18:54

Merge remote-tracking branch 'origin/main' into copilot/fix-template-…

8c0d68d

…injection-vulnerability # Conflicts: # .github/workflows/smoke-copilot-playwright.lock.yml

Merge main, recompile workflows, and format code

1afa626

Co-authored-by: pelikhan <4175913+pelikhan@users.noreply.github.com>

pelikhan added smoke and removed smoke labels Dec 7, 2025

Copilot finished work on behalf of pelikhan December 7, 2025 19:01

pelikhan marked this pull request as ready for review December 7, 2025 19:01

Copilot started work on behalf of pelikhan December 7, 2025 19:43 View session

GitHub Copilot and others added 2 commits December 7, 2025 19:46

Merge remote-tracking branch 'origin/main' into copilot/fix-template-…

ad120b4

…injection-vulnerability # Conflicts: # .github/workflows/spec-kit-executor.lock.yml # pkg/workflow/js.go

Merge main and recompile workflows

2dfc324

Co-authored-by: pelikhan <4175913+pelikhan@users.noreply.github.com>

Copilot finished work on behalf of pelikhan December 7, 2025 19:49

pelikhan added smoke and removed smoke smoke-claude smoke-copilot labels Dec 7, 2025

github-actions bot added the smoke-copilot label Dec 7, 2025

github-actions bot added smoke-claude smoke-copilot-no-firewall labels Dec 7, 2025

Add changeset [skip-ci]

ba93d48

pelikhan merged commit 09acc52 into main Dec 7, 2025
5 checks passed

pelikhan deleted the copilot/fix-template-injection-vulnerability branch December 7, 2025 20:17

github-actions bot mentioned this pull request Dec 7, 2025

Fix safe-inputs MCP server to use HTTP transport for Codex engine #5782

Merged

Copilot AI mentioned this pull request Dec 16, 2025

[WIP] Fix template injection in single-instance workflows #6617

Closed

11 tasks

Replace envsubst with JavaScript-based substitution to prevent template injection #5773

Replace envsubst with JavaScript-based substitution to prevent template injection #5773

Uh oh!

Conversation

Copilot AI commented Dec 7, 2025 • edited by github-actions bot Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Merged main branch

Summary

Context

Current Vulnerable Pattern

Required Changes

Files to Modify

Testing

Acceptance Criteria

Comments on the Issue (you are @copilot in this section)

Changeset

Smoke Test Summary - Run 20009235856

Changeset

Smoke Test Summary - 2025-12-07T20:15:49Z

Uh oh!

pelikhan left a comment

Choose a reason for hiding this comment

Uh oh!

Copilot AI commented Dec 7, 2025

Uh oh!

pelikhan commented Dec 7, 2025

Uh oh!

Copilot AI commented Dec 7, 2025

Uh oh!

github-actions bot commented Dec 7, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

github-actions bot commented Dec 7, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

Copilot AI commented Dec 7, 2025

Uh oh!

github-actions bot commented Dec 7, 2025

Uh oh!

github-actions bot commented Dec 7, 2025

Uh oh!

github-actions bot commented Dec 7, 2025

Uh oh!

github-actions bot commented Dec 7, 2025

Uh oh!

github-actions bot commented Dec 7, 2025

Uh oh!

github-actions bot commented Dec 7, 2025

Uh oh!

github-actions bot commented Dec 7, 2025 • edited by agentic-workflows-dev bot Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

github-actions bot commented Dec 7, 2025

Smoke Test: Copilot Engine Validation - Run 20009718258

Uh oh!

github-actions bot commented Dec 7, 2025

Smoke Test Results - Run 20009718274

Uh oh!

github-actions bot commented Dec 7, 2025

Smoke Test Results - Run 20009718248

Uh oh!

github-actions bot commented Dec 7, 2025

Copilot Engine Smoke Test Results

Uh oh!

github-actions bot commented Dec 7, 2025

Smoke Test Results (Run 20009718520)

Uh oh!

Uh oh!

github-actions bot commented Dec 7, 2025

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

Copilot AI commented Dec 7, 2025 •

edited by github-actions bot

Loading

github-actions bot commented Dec 7, 2025 •

edited

Loading

github-actions bot commented Dec 7, 2025 •

edited

Loading

github-actions bot commented Dec 7, 2025 •

edited by agentic-workflows-dev bot

Loading