Skip to content

Commit 1e79076

Browse files
juliojimenezjuliojimenez
authored
Sanitize S3 Key, Debug Input, Licenses 2025-07-24 (#18)
* Sanitize S3 Key, Debug Input, Licenses 2025-07-24 Signed-off-by: Julio Jimenez <[email protected]> * licenses Signed-off-by: Julio Jimenez <[email protected]> * licenses Signed-off-by: Julio Jimenez <[email protected]> * debug condition Signed-off-by: Julio Jimenez <[email protected]> * licenses Signed-off-by: Julio Jimenez <[email protected]> --------- Signed-off-by: Julio Jimenez <[email protected]>
1 parent aac273c commit 1e79076

File tree

6 files changed

+135
-24
lines changed

6 files changed

+135
-24
lines changed

‎README.md‎

Lines changed: 18 additions & 18 deletions
Original file line numberDiff line numberDiff line change
@@ -125,11 +125,11 @@ jobs:
125125

126126
steps:
127127
- name: Checkout repository
128-
uses: actions/checkout@v2
128+
uses: actions/checkout@v4
129129

130130
- name: Configure AWS Credentials
131131
id: aws-creds
132-
uses: aws-actions/configure-aws-credentials@v1
132+
uses: aws-actions/configure-aws-credentials@v4
133133
with:
134134
role-to-assume: arn:aws:iam::012345678912:role/GitHubOIDCRole
135135
role-session-name: clickbom-session
@@ -168,11 +168,11 @@ jobs:
168168

169169
steps:
170170
- name: Checkout repository
171-
uses: actions/checkout@v2
171+
uses: actions/checkout@v4
172172

173173
- name: Configure AWS Credentials
174174
id: aws-creds
175-
uses: aws-actions/configure-aws-credentials@v1
175+
uses: aws-actions/configure-aws-credentials@v4
176176
with:
177177
role-to-assume: arn:aws:iam::012345678912:role/GitHubOIDCRole
178178
role-session-name: clickbom-session
@@ -215,7 +215,7 @@ jobs:
215215

216216
steps:
217217
- name: Checkout repository
218-
uses: actions/checkout@v2
218+
uses: actions/checkout@v4
219219

220220
- name: Generate Token
221221
id: generate-token
@@ -226,7 +226,7 @@ jobs:
226226

227227
- name: Configure AWS Credentials
228228
id: aws-creds
229-
uses: aws-actions/configure-aws-credentials@v1
229+
uses: aws-actions/configure-aws-credentials@v4
230230
with:
231231
role-to-assume: arn:aws:iam::012345678912:role/GitHubOIDCRole
232232
role-session-name: clickbom-session
@@ -278,7 +278,7 @@ jobs:
278278

279279
steps:
280280
- name: Checkout repository
281-
uses: actions/checkout@v2
281+
uses: actions/checkout@v4
282282

283283
- name: Generate Token
284284
id: generate-token
@@ -291,7 +291,7 @@ jobs:
291291

292292
- name: Configure AWS Credentials
293293
id: aws-creds
294-
uses: aws-actions/configure-aws-credentials@v1
294+
uses: aws-actions/configure-aws-credentials@v4
295295
with:
296296
role-to-assume: arn:aws:iam::012345678912:role/GitHubOIDCRole
297297
role-session-name: clickbom-session
@@ -342,7 +342,7 @@ jobs:
342342

343343
steps:
344344
- name: Checkout repository
345-
uses: actions/checkout@v2
345+
uses: actions/checkout@v4
346346

347347
- name: Generate Token
348348
id: generate-token
@@ -355,7 +355,7 @@ jobs:
355355

356356
- name: Configure AWS Credentials
357357
id: aws-creds
358-
uses: aws-actions/configure-aws-credentials@v1
358+
uses: aws-actions/configure-aws-credentials@v4
359359
with:
360360
role-to-assume: arn:aws:iam::012345678912:role/GitHubOIDCRole
361361
role-session-name: clickbom-session
@@ -386,7 +386,7 @@ jobs:
386386

387387
steps:
388388
- name: Checkout repository
389-
uses: actions/checkout@v2
389+
uses: actions/checkout@v4
390390

391391
- name: Generate Token
392392
id: generate-token
@@ -397,7 +397,7 @@ jobs:
397397

398398
- name: Configure AWS Credentials
399399
id: aws-creds
400-
uses: aws-actions/configure-aws-credentials@v1
400+
uses: aws-actions/configure-aws-credentials@v4
401401
with:
402402
role-to-assume: arn:aws:iam::012345678912:role/GitHubOIDCRole
403403
role-session-name: clickbom-session
@@ -440,7 +440,7 @@ jobs:
440440
441441
steps:
442442
- name: Checkout repository
443-
uses: actions/checkout@v2
443+
uses: actions/checkout@v4
444444
445445
- name: Generate Token
446446
id: generate-token
@@ -451,7 +451,7 @@ jobs:
451451
452452
- name: Configure AWS Credentials
453453
id: aws-creds
454-
uses: aws-actions/configure-aws-credentials@v1
454+
uses: aws-actions/configure-aws-credentials@v4
455455
with:
456456
role-to-assume: arn:aws:iam::012345678912:role/GitHubOIDCRole
457457
role-session-name: clickbom-session
@@ -502,11 +502,11 @@ jobs:
502502
503503
steps:
504504
- name: Checkout repository
505-
uses: actions/checkout@v2
505+
uses: actions/checkout@v4
506506
507507
- name: Configure AWS Credentials
508508
id: aws-creds
509-
uses: aws-actions/configure-aws-credentials@v1
509+
uses: aws-actions/configure-aws-credentials@v4
510510
with:
511511
role-to-assume: arn:aws:iam::012345678912:role/GitHubOIDCRole
512512
role-session-name: clickbom-session
@@ -553,11 +553,11 @@ jobs:
553553
554554
steps:
555555
- name: Checkout repository
556-
uses: actions/checkout@v2
556+
uses: actions/checkout@v4
557557
558558
- name: Configure AWS Credentials
559559
id: aws-creds
560-
uses: aws-actions/configure-aws-credentials@v1
560+
uses: aws-actions/configure-aws-credentials@v4
561561
with:
562562
role-to-assume: arn:aws:iam::012345678912:role/GitHubOIDCRole
563563
role-session-name: clickbom-session

‎action.yml‎

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -118,6 +118,10 @@ inputs:
118118
description: 'Comma-separated list of filenames or patterns to exclude when merging (only used with merge=true)'
119119
required: false
120120
default: ''
121+
debug:
122+
description: 'Enable debug logging'
123+
required: false
124+
default: 'false'
121125
runs:
122126
using: 'docker'
123127
image: 'Dockerfile'
@@ -160,6 +164,7 @@ runs:
160164
MERGE: ${{ inputs.merge }}
161165
INCLUDE: ${{ inputs.include }}
162166
EXCLUDE: ${{ inputs.exclude }}
167+
DEBUG: ${{ inputs.debug }}
163168
branding:
164169
icon: 'list'
165170
color: 'yellow'

‎entrypoint.sh‎

Lines changed: 3 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -18,7 +18,9 @@ NC='\033[0m' # No Color
1818

1919
# Logging functions
2020
log_debug() {
21-
echo -e "${ORANGE}[DEBUG]${NC} $1"
21+
if [[ "${DEBUG:-false}" == "true" ]]; then
22+
echo -e "${ORANGE}[DEBUG]${NC} $1"
23+
fi
2224
}
2325

2426
log_info() {

‎lib/sanitize.sh‎

Lines changed: 27 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -105,6 +105,29 @@ sanitize_s3_bucket() {
105105
echo "$sanitized"
106106
}
107107

108+
# Sanitize S3 key
109+
sanitize_s3_key() {
110+
local key="$1"
111+
112+
# S3 keys can contain most characters but we'll be restrictive for security
113+
local sanitized
114+
sanitized=$(echo "$key" | sed 's/[^a-zA-Z0-9._/-]//g')
115+
116+
# Prevent path traversal attempts
117+
sanitized=$(echo "$sanitized" | sed 's/\.\.//g' | sed 's/\/\+/\//g')
118+
119+
# Remove leading/trailing slashes
120+
sanitized=$(echo "$sanitized" | sed 's/^\/*//' | sed 's/\/*$//')
121+
122+
if [[ -z "$sanitized" ]]; then
123+
log_error "Invalid S3 key: $key"
124+
log_error "S3 key must contain valid characters and cannot be empty"
125+
exit 1
126+
fi
127+
128+
echo "$sanitized"
129+
}
130+
108131
# Main sanitization function - sanitizes all environment variables
109132
sanitize_inputs() {
110133
log_debug "Sanitizing input parameters..."
@@ -222,10 +245,10 @@ sanitize_inputs() {
222245
log_debug "Sanitized S3_BUCKET: $S3_BUCKET"
223246
fi
224247

225-
# if [[ -n "${S3_KEY:-}" ]]; then
226-
# S3_KEY=$(sanitize_s3_key "$S3_KEY")
227-
# log_debug "Sanitized S3_KEY: $S3_KEY"
228-
# fi
248+
if [[ -n "${S3_KEY:-}" ]]; then
249+
S3_KEY=$(sanitize_s3_key "$S3_KEY")
250+
log_debug "Sanitized S3_KEY: $S3_KEY"
251+
fi
229252

230253
# ClickHouse inputs
231254
if [[ -n "${CLICKHOUSE_URL:-}" ]]; then

‎license-mappings.json‎

Lines changed: 25 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -86,8 +86,33 @@
8686
"fyne.io/systray": "Apache-2.0",
8787
"git.sr.ht/~sbinet/gg": "MIT",
8888
"github.com/4meepo/tagalign": "MIT",
89+
"github.com/Abirdcfly/dupword": "MIT",
90+
"github.com/AdaLogics/go-fuzz-headers": "Apache-2.0",
8991
"github.com/andybalholm/brotli": "MIT",
92+
"github.com/Antonboom/errname": "MIT",
93+
"github.com/Antonboom/nilnil": "MIT",
94+
"github.com/Antonboom/testifylint": "MIT",
95+
"github.com/Azure/azure-amqp-common-go/v3": "MIT",
96+
"github.com/Azure/azure-pipeline-go": "MIT",
97+
"github.com/Azure/azure-sdk-for-go-extensions": "MIT",
98+
"github.com/Azure/azure-sdk-for-go/sdk/azcore": "MIT",
99+
"github.com/Azure/azure-sdk-for-go/sdk/azidentity": "MIT",
100+
"github.com/Azure/azure-sdk-for-go/sdk/containers/azcontainerregistry": "MIT",
101+
"github.com/Azure/azure-sdk-for-go/sdk/internal": "MIT",
102+
"github.com/Azure/azure-sdk-for-go/sdk/messaging/azservicebus": "MIT",
103+
"github.com/Azure/azure-sdk-for-go/sdk/resourcemanager/authorization/armauthorization/v3": "MIT",
104+
"github.com/Azure/azure-sdk-for-go/sdk/resourcemanager/containerservice/armcontainerservice/v4": "MIT",
105+
"github.com/Azure/azure-sdk-for-go/sdk/resourcemanager/containerservice/armcontainerservice/v6": "MIT",
106+
"github.com/Azure/azure-sdk-for-go/sdk/resourcemanager/msi/armmsi": "MIT",
107+
"github.com/Azure/azure-sdk-for-go/sdk/resourcemanager/network/armnetwork/v5": "MIT",
108+
"github.com/Azure/azure-sdk-for-go/sdk/resourcemanager/resourcegraph/armresourcegraph": "MIT",
109+
"github.com/Azure/azure-sdk-for-go/sdk/resourcemanager/resources/armresources": "MIT",
110+
"github.com/Azure/azure-sdk-for-go/sdk/storage/azblob": "MIT",
111+
"github.com/Azure/azure-storage-blob-go": "MIT",
112+
"github.com/Azure/go-amqp": "MIT",
90113
"github.com/Azure/go-ansiterm": "MIT",
114+
"github.com/AzureAD/microsoft-authentication-library-for-go": "MIT",
115+
"github.com/BurntSushi/toml": "MIT",
91116
"github.com/cenkalti/backoff/v4": "MIT",
92117
"github.com/ClickHouse/ch-go": "Apache-2.0",
93118
"github.com/containerd/errdefs": "Apache-2.0",

‎test/simple.bats‎

Lines changed: 57 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -516,4 +516,60 @@ EOF
516516
run sanitize_s3_bucket "invalid-bucket-"
517517
[ "$status" -eq 1 ]
518518
[[ "$output" == *"Invalid S3 bucket name"* ]]
519-
}
519+
}
520+
521+
# Test 52: sanitize_s3_key accepts valid S3 key
522+
@test "sanitize_s3_key accepts valid key" {
523+
run sanitize_s3_key "path/to/file.json"
524+
[ "$status" -eq 0 ]
525+
[[ "$output" == "path/to/file.json" ]]
526+
}
527+
528+
# Test 53: sanitize_s3_key removes dangerous characters
529+
@test "sanitize_s3_key removes dangerous characters" {
530+
run sanitize_s3_key "path/to/file\$bad.json"
531+
[ "$status" -eq 0 ]
532+
[[ "$output" == "path/to/filebad.json" ]]
533+
}
534+
535+
# Test 54: sanitize_s3_key prevents path traversal
536+
@test "sanitize_s3_key prevents path traversal" {
537+
run sanitize_s3_key "../../../etc/passwd"
538+
[ "$status" -eq 0 ]
539+
[[ "$output" == "etc/passwd" ]]
540+
}
541+
542+
# Test 55: sanitize_s3_key removes multiple slashes
543+
@test "sanitize_s3_key removes multiple slashes" {
544+
run sanitize_s3_key "path//to///file.json"
545+
[ "$status" -eq 0 ]
546+
[[ "$output" == "path/to/file.json" ]]
547+
}
548+
549+
# Test 56: sanitize_s3_key removes leading slash
550+
@test "sanitize_s3_key removes leading slash" {
551+
run sanitize_s3_key "/path/to/file.json"
552+
[ "$status" -eq 0 ]
553+
[[ "$output" == "path/to/file.json" ]]
554+
}
555+
556+
# Test 57: sanitize_s3_key removes trailing slash
557+
@test "sanitize_s3_key removes trailing slash" {
558+
run sanitize_s3_key "path/to/file.json/"
559+
[ "$status" -eq 0 ]
560+
[[ "$output" == "path/to/file.json" ]]
561+
}
562+
563+
# Test 58: sanitize_s3_key rejects empty key
564+
@test "sanitize_s3_key rejects empty key" {
565+
run sanitize_s3_key ""
566+
[ "$status" -eq 1 ]
567+
[[ "$output" == *"Invalid S3 key"* ]]
568+
}
569+
570+
# Test 59: sanitize_s3_key rejects key with only invalid characters
571+
@test "sanitize_s3_key rejects key with only invalid characters" {
572+
run sanitize_s3_key "\$%^&*()"
573+
[ "$status" -eq 1 ]
574+
[[ "$output" == *"Invalid S3 key"* ]]
575+
}

0 commit comments

Comments
 (0)