diff options
| author | Aiqiao Yan <55104035+aiqiaoy@users.noreply.github.com> | 2026-07-15 15:05:42 -0400 |
|---|---|---|
| committer | GitHub <noreply@github.com> | 2026-07-15 15:05:42 -0400 |
| commit | 352b30b96cc74c8ce95cc4c682fadf6a89d9eb63 (patch) | |
| tree | d0951ccc59e9128cfbf2cfebee8fefe2db459008 /src/input-helper.ts | |
| parent | 76455ef5af5e6c1ef9b1743192c21303bad9dbfc (diff) | |
trim only ascii whitespace for branch (#2521)
* trim only ascii whitespace for branch
* rebuild
Diffstat (limited to 'src/input-helper.ts')
| -rw-r--r-- | src/input-helper.ts | 21 |
1 files changed, 19 insertions, 2 deletions
diff --git a/src/input-helper.ts b/src/input-helper.ts index 87b2800..9a98b86 100644 --- a/src/input-helper.ts +++ b/src/input-helper.ts @@ -59,6 +59,23 @@ export async function getInputs(): Promise<IGitSourceSettings> { // Source branch, source version result.ref = core.getInput('ref') + // core.getInput()'s default trim strips a range of Unicode characters such as a + // leading BOM (U+FEFF) or NBSP (U+00A0). Those are valid in a git ref name, so + // a fork branch named "<BOM>" + 40 hex chars would trim down to a bare SHA and + // be silently reclassified as a commit, bypassing the unsafe fork PR checkout + // guard. + // + // The trim below strips only the ASCII whitespace characters which are all forbidden + // in a git branch name. + // \t U+0009 horizontal tab - ASCII control, forbidden in ref names + // \n U+000A line feed - ASCII control, forbidden in ref names + // \v U+000B vertical tab - ASCII control, forbidden in ref names + // \f U+000C form feed - ASCII control, forbidden in ref names + // \r U+000D carriage return - ASCII control, forbidden in ref names + // ' ' U+0020 space - forbidden in ref names + const asciiTrimmedRef = core + .getInput('ref', {trimWhitespace: false}) + .replace(/^[\t\n\v\f\r ]+|[\t\n\v\f\r ]+$/g, '') if (!result.ref) { if (isWorkflowRepository) { result.ref = github.context.ref @@ -72,8 +89,8 @@ export async function getInputs(): Promise<IGitSourceSettings> { } } // SHA? - else if (result.ref.match(/^(?:[0-9a-fA-F]{40}|[0-9a-fA-F]{64})$/)) { - result.commit = result.ref + else if (asciiTrimmedRef.match(/^(?:[0-9a-fA-F]{40}|[0-9a-fA-F]{64})$/)) { + result.commit = asciiTrimmedRef result.ref = '' } core.debug(`ref = '${result.ref}'`) |