CI and script hygiene: pass head_ref via env, remove Invoke-Expression from utils.ps1
Nobody has claimed this yet.
Assessment
- Difficulty
- 2/5
- Estimated time
- 1-3 hours
- Newbie friendliness
- 75/100
Research direction
The issue points to specific lines in .github/workflows/build.yml, tests.yml, codeql.yml and scripts/utils.ps1. First, read the linked lines to understand the current code. For the workflows, change the syntax to pass github.head_ref via an environment variable. In utils.ps1, replace Invoke-Expression calls with direct invocation (e.g., & 7z ...). Also consider adding a name validation regex in build.ps1. Test by running the scripts locally or checking CI runs after changes.
Written by the indexing model from the issue text.
Description
Summary
Two small hygiene fixes in the CI workflows and build scripts. Neither is exploitable today, but both are easy to get wrong later.
1. Pass github.head_ref through env: in workflows
build.yml, tests.yml and codeql.yml paste the PR branch name straight into a PowerShell double-quoted string:
$headRef = "${{ github.head_ref }}"
Git branch names may contain $(...), which PowerShell evaluates inside double quotes. These workflows run on pull_request, so fork PRs get a read-only token and already run their own scripts, so nothing is gained today. It would become a real injection if any of them moved to pull_request_target or gained secrets. GitHub's recommended pattern:
env:
HEAD_REF: ${{ github.head_ref }}
run: |
$headRef = $env:HEAD_REF
2. Replace Invoke-Expression in scripts/utils.ps1
Extract-Archive, Create-Archive, Digest-Hash and Get-VersionStr build command strings and run them with Invoke-Expression (utils.ps1#L73, #L84, #L108, #L149-L152). The name values from sources.json (or a custom -SourcesPath) end up in those strings, so a name containing $(...) would run as code. The same names are also passed to Remove-Item -Recurse -Force, so a name like ..\.. would delete outside vendor/.
Suggested changes:
- Call the tools directly, e.g.
& 7z x -y "-o$target" $source. - Validate
nameagainst something like^[A-Za-z0-9._-]+$inbuild.ps1.
- Dominant language
- PowerShell
- Stars
- 27k
- Forks
- 2.1k
- PR merge metrics
- No merged PRs in 30d
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
More from cmderdev/cmder
-
Difficulty 2/5 1-3 hours Newbie friendliness 75/100
-
Difficulty 3/5 1-2 days Newbie friendliness 65/100
-
Difficulty 3/5 1-2 days Newbie friendliness 40/100
-
Difficulty 3/5 1-2 days Newbie friendliness 65/100
-
Difficulty 3/5 1-2 days Newbie friendliness 65/100
Similar issues
-
agent-ready documentation needs-triage
Difficulty 1/5 1-3 hours Newbie friendliness 88/100
-
area-deployment area-integrations triage:bot-seen
Difficulty 2/5 Half a day Newbie friendliness 86/100
-
agentic-workflows
Difficulty 2/5 1-3 hours Newbie friendliness 76/100
-
refactor
Difficulty 2/5 1-3 hours Newbie friendliness 78/100
-
bug build
Difficulty 1/5 Under an hour Newbie friendliness 91/100
facebookincubator/velox#19194 ·