Hacktoberfest 2026 : les issues que les mainteneurs ont marquées pour octobre, ouvertes et accessibles aux débutants. Parcourir les issues Hacktoberfest

Error when calling createComment with markdown in body

Ouverte
#723 1 commentaire 0 réactions 0 personnes assignées Voir sur GitHub

Personne n'a encore pris cette issue.

Évaluation

Difficulté
3/5
Temps estimé
1-2 jours
Accessibilité débutants
55/100
Type d'issue
Bug
Clarté
Plutôt claire
Activité
Calme
Stack technique
github, github-actions, javascript, typescript
Domaine
api, ci-cd, devops

Piste de recherche

Reproduce the workflow step using actions/github-script@v9.0.0 and github.rest.issues.createComment with the shown nested Markdown and code fences, then inspect the action's script evaluation and comment request path. Done means the exact body creates a comment without the SyntaxError, including its backticks and pickle text.

Rédigé par le modèle d'indexation à partir du texte de l'issue.

Description

Describe the bug
The following error is thrown:
Error: Unhandled error: SyntaxError: Unexpected identifier 'pickle'

To Reproduce
Steps to reproduce the behavior:
run the following action step:

    - name: Create comment
      uses: actions/github-script@v9.0.0
      with:
        github-token: ${{ inputs.github-token }}
        script: |
          github.rest.issues.createComment({
            issue_number: context.issue.number,
            owner: context.repo.owner,
            repo: context.repo.repo,
            body: `### 1. **Arbitrary Code Execution via `pickle.loads()` on Untrusted Input** (`test01.py`)
 
              **Severity: CRITICAL**
             
              The file `test01.py` takes user input directly and passes it to `pickle.loads()`. This is a well-known **Remote Code Execution (RCE)** vulnerability. An attacker can craft a malicious pickle payload that executes arbitrary system commands upon deserialization.
             
              Additionally, `pickle.loads()` expects `bytes`, but `input()` returns a `str` in Python 3, so this code will also raise a **`TypeError`** at runtime.
             
              **File: `test01.py`**
             
              ```python
              # Current (vulnerable and broken):
              import pickle
             
              data = input("Enter serialized data: ")
              obj = pickle.loads(data)
              ```
             
              **Suggested fix:**
             
              ```python
              import json
             
              data = input("Enter serialized data: ")
              obj = json.loads(data)
              ```
             
              If `pickle` is absolutely required (not recommended with untrusted input), at minimum fix the type error and restrict allowed classes:
             
              ```python
              import pickle
              import io
             
              ALLOWED_CLASSES = {
                  # explicitly list allowed classes here
              }
             
              class RestrictedUnpickler(pickle.Unpickler):
                  def find_class(self, module, name):
                      if (module, name) in ALLOWED_CLASSES:
                          return ALLOWED_CLASSES[(module, name)]
                      raise pickle.UnpicklingError(f"Forbidden class: {module}.{name}")
             
              data = input("Enter serialized data: ")
              obj = RestrictedUnpickler(io.BytesIO(data.encode('latin-1'))).load()
              ```
            `
          })

Expected behavior
No error and comment is created.

Desktop (please complete the following information):

  • OS: Ubuntu 22.04
  • Runner 2.331.0

Additional context
The markdown text is actually a dynamic response generated by a LLM, hence no way to modify the markdown contents.

Langage dominant
TypeScript
Étoiles
5k
Forks
586
Métriques de merge des PR
Aucune PR mergée en 30 j

Guide de contribution

Aucun guide de contribution indexé pour ce dépôt

Par où commencer

  1. Lisez l'issue en entier, puis le guide de contribution du projet.
  2. Signalez en commentaire que vous la prenez — cela évite que deux personnes fassent le même travail.
  3. Forkez le dépôt et travaillez sur une branche.
  4. Ouvrez une pull request qui référence le numéro de l'issue.

Autres issues de actions/github-script

Toutes les issues de actions/github-script

Issues similaires

Plus d'issues TypeScript

Recevez les nouvelles issues par e-mail

Un résumé court des issues GitHub adaptées aux débutants.