fix: mitigated script injection in test install action (#404)

lindell · Oct 28, 2023 · f77ef91 · f77ef91
1 parent f893e91
commit f77ef91
Showing 1 changed file with 4 additions and 2 deletions.
diff --git a/.github/workflows/test-install.yaml b/.github/workflows/test-install.yaml
@@ -20,9 +20,11 @@ jobs:
       - name: Install multi-gitter
         env:
           BINDIR: ${{ github.workspace }}/bin
+          FULL_NAME: ${{ github.event.pull_request.head.repo.full_name }}
+          REF: ${{ github.head_ref }}
         run: |
-          curl -s https://raw.githubusercontent.com/${{ github.event.pull_request.head.repo.full_name }}/${{ github.head_ref }}/install.sh | sh -s -- -d
-          echo "${{ github.workspace }}/bin" >> $GITHUB_PATH
+          curl -s https://raw.githubusercontent.com/$FULL_NAME/$REF/install.sh | sh -s -- -d
+          echo "$BINDIR" >> $GITHUB_PATH
         shell: sh
       - name: Print version
         run: multi-gitter version