From 0ec86b66671886ef35af34611748ef291f5c21fc Mon Sep 17 00:00:00 2001 From: CeyConnect Deploy Date: Fri, 25 Sep 2026 18:09:30 +0000 Subject: [PATCH] fix: eliminate shell injection in Telegram notify steps MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit The Notify Build Start/Complete and Notify Deploy Complete/Failure steps interpolated ${{ github.event.head_commit.message }} (and actor/timestamp/repository/secrets) directly into a run: bash script inside a double-quoted curl argument. A commit message containing backticks or double quotes breaks or hijacks the script: - PR #69's message contained `time`, which bash expanded as command substitution (harmlessly ran the `time` builtin here, but the primitive is a real injection point). - PR #70's message contained embedded double quotes, which closed the -d text="..." string early and caused a bash syntax error (exit 2). Both caused the job to abort at the very first step, before checkout, so neither PR's deploy ever ran the build/deploy steps. Fix: route every untrusted/secret value through env: (context expressions there are not re-parsed by the shell) and reference them as $VAR inside the script, using GITHUB_REPOSITORY/GITHUB_ACTOR (already provided by the runner) for repo/actor. Also switch from -d to --data-urlencode so control characters in the commit message can't corrupt the form-encoded POST body sent to Telegram. Verified against the two commit messages that broke prod deploys plus a payload with backticks, $(), and embedded quotes/semicolons — no syntax error and no code execution in any case. Drive-by: fixed mojibake '�' -> '📦' in the Build Complete message. Co-Authored-By: Claude Sonnet 5 --- .github/workflows/build-deploy-dev.yml | 84 +++++++++++++++----------- .github/workflows/build-deploy.yml | 84 +++++++++++++++----------- 2 files changed, 100 insertions(+), 68 deletions(-) diff --git a/.github/workflows/build-deploy-dev.yml b/.github/workflows/build-deploy-dev.yml index 828820d1..4351322b 100644 --- a/.github/workflows/build-deploy-dev.yml +++ b/.github/workflows/build-deploy-dev.yml @@ -23,29 +23,37 @@ jobs: steps: - name: Notify Build Start - run: | - curl -s -X POST https://api.telegram.org/bot${{ secrets.DEV_ACTIONS_BOT_TOKEN }}/sendMessage \ - -d chat_id="${{ secrets.DEV_ACTIONS_GROUP_ID }}" \ - -d text=" - ${{ env.PROJECT_NAME }} Build Started 🚀 - 📁 Repository: ${{ github.repository }} - 👤 Initiator: ${{ github.actor }} - 🕒 Timestamp: ${{ github.event.head_commit.timestamp}} - 📝 Commit Message: ${{ github.event.head_commit.message }}" + env: + TELEGRAM_BOT_TOKEN: ${{ secrets.DEV_ACTIONS_BOT_TOKEN }} + TELEGRAM_CHAT_ID: ${{ secrets.DEV_ACTIONS_GROUP_ID }} + COMMIT_MESSAGE: ${{ github.event.head_commit.message }} + COMMIT_TIMESTAMP: ${{ github.event.head_commit.timestamp }} + run: | + curl -s -X POST "https://api.telegram.org/bot${TELEGRAM_BOT_TOKEN}/sendMessage" \ + --data-urlencode "chat_id=${TELEGRAM_CHAT_ID}" \ + --data-urlencode "text=${PROJECT_NAME} Build Started 🚀 + 📁 Repository: ${GITHUB_REPOSITORY} + 👤 Initiator: ${GITHUB_ACTOR} + 🕒 Timestamp: ${COMMIT_TIMESTAMP} + 📝 Commit Message: ${COMMIT_MESSAGE}" - name: Checkout Code uses: actions/checkout@v4 - name: Notify Build Complete + env: + TELEGRAM_BOT_TOKEN: ${{ secrets.DEV_ACTIONS_BOT_TOKEN }} + TELEGRAM_CHAT_ID: ${{ secrets.DEV_ACTIONS_GROUP_ID }} + COMMIT_MESSAGE: ${{ github.event.head_commit.message }} + COMMIT_TIMESTAMP: ${{ github.event.head_commit.timestamp }} run: | - curl -s -X POST https://api.telegram.org/bot${{ secrets.DEV_ACTIONS_BOT_TOKEN }}/sendMessage \ - -d chat_id="${{ secrets.DEV_ACTIONS_GROUP_ID }}" \ - -d text=" - ${{ env.PROJECT_NAME }} Code Checked Out � - 📁 Repository: ${{ github.repository }} - 👤 Initiator: ${{ github.actor }} - 🕒 Timestamp: ${{ github.event.head_commit.timestamp }} - 📝 Commit Message: ${{ github.event.head_commit.message }}" + curl -s -X POST "https://api.telegram.org/bot${TELEGRAM_BOT_TOKEN}/sendMessage" \ + --data-urlencode "chat_id=${TELEGRAM_CHAT_ID}" \ + --data-urlencode "text=${PROJECT_NAME} Code Checked Out 📦 + 📁 Repository: ${GITHUB_REPOSITORY} + 👤 Initiator: ${GITHUB_ACTOR} + 🕒 Timestamp: ${COMMIT_TIMESTAMP} + 📝 Commit Message: ${COMMIT_MESSAGE}" # ✅ Check if .git directory exists remotely - name: Check if Git Exists on Server @@ -148,26 +156,34 @@ jobs: sudo systemctl status ${{ env.SERVICE_NAME }} --no-pager - name: Notify Deploy Complete + env: + TELEGRAM_BOT_TOKEN: ${{ secrets.DEV_ACTIONS_BOT_TOKEN }} + TELEGRAM_CHAT_ID: ${{ secrets.DEV_ACTIONS_GROUP_ID }} + COMMIT_MESSAGE: ${{ github.event.head_commit.message }} + COMMIT_TIMESTAMP: ${{ github.event.head_commit.timestamp }} run: | - curl -s -X POST https://api.telegram.org/bot${{ secrets.DEV_ACTIONS_BOT_TOKEN }}/sendMessage \ - -d chat_id="${{ secrets.DEV_ACTIONS_GROUP_ID }}" \ - -d text=" - ${{ env.PROJECT_NAME }} Deploy Complete ✅ - 📁 Repository: ${{ github.repository }} - 👤 Initiator: ${{ github.actor }} - 🕒 Timestamp: ${{ github.event.head_commit.timestamp }} - 📝 Commit Message: ${{ github.event.head_commit.message }}" + curl -s -X POST "https://api.telegram.org/bot${TELEGRAM_BOT_TOKEN}/sendMessage" \ + --data-urlencode "chat_id=${TELEGRAM_CHAT_ID}" \ + --data-urlencode "text=${PROJECT_NAME} Deploy Complete ✅ + 📁 Repository: ${GITHUB_REPOSITORY} + 👤 Initiator: ${GITHUB_ACTOR} + 🕒 Timestamp: ${COMMIT_TIMESTAMP} + 📝 Commit Message: ${COMMIT_MESSAGE}" - name: Notify Deploy Failure if: failure() + env: + TELEGRAM_BOT_TOKEN: ${{ secrets.DEV_ACTIONS_BOT_TOKEN }} + TELEGRAM_CHAT_ID: ${{ secrets.DEV_ACTIONS_GROUP_ID }} + COMMIT_MESSAGE: ${{ github.event.head_commit.message }} + COMMIT_TIMESTAMP: ${{ github.event.head_commit.timestamp }} run: | - curl -s -X POST https://api.telegram.org/bot${{ secrets.DEV_ACTIONS_BOT_TOKEN }}/sendMessage \ - -d chat_id="${{ secrets.DEV_ACTIONS_GROUP_ID }}" \ - -d text=" - ❌ ${{ env.PROJECT_NAME }} Deploy Failed! - 📁 Repository: ${{ github.repository }} - 👤 Initiator: ${{ github.actor }} - 🕒 Timestamp: ${{ github.event.head_commit.timestamp }} - 📝 Commit Message: ${{ github.event.head_commit.message }} - + curl -s -X POST "https://api.telegram.org/bot${TELEGRAM_BOT_TOKEN}/sendMessage" \ + --data-urlencode "chat_id=${TELEGRAM_CHAT_ID}" \ + --data-urlencode "text=❌ ${PROJECT_NAME} Deploy Failed! + 📁 Repository: ${GITHUB_REPOSITORY} + 👤 Initiator: ${GITHUB_ACTOR} + 🕒 Timestamp: ${COMMIT_TIMESTAMP} + 📝 Commit Message: ${COMMIT_MESSAGE} + Please check the GitHub Actions logs for more details." diff --git a/.github/workflows/build-deploy.yml b/.github/workflows/build-deploy.yml index a6e7240f..138e7066 100644 --- a/.github/workflows/build-deploy.yml +++ b/.github/workflows/build-deploy.yml @@ -22,29 +22,37 @@ jobs: steps: - name: Notify Build Start - run: | - curl -s -X POST https://api.telegram.org/bot${{ secrets.DEV_ACTIONS_BOT_TOKEN }}/sendMessage \ - -d chat_id="${{ secrets.DEV_ACTIONS_GROUP_ID }}" \ - -d text=" - ${{ env.PROJECT_NAME }} Build Started 🚀 - 📁 Repository: ${{ github.repository }} - 👤 Initiator: ${{ github.actor }} - 🕒 Timestamp: ${{ github.event.head_commit.timestamp}} - 📝 Commit Message: ${{ github.event.head_commit.message }}" + env: + TELEGRAM_BOT_TOKEN: ${{ secrets.DEV_ACTIONS_BOT_TOKEN }} + TELEGRAM_CHAT_ID: ${{ secrets.DEV_ACTIONS_GROUP_ID }} + COMMIT_MESSAGE: ${{ github.event.head_commit.message }} + COMMIT_TIMESTAMP: ${{ github.event.head_commit.timestamp }} + run: | + curl -s -X POST "https://api.telegram.org/bot${TELEGRAM_BOT_TOKEN}/sendMessage" \ + --data-urlencode "chat_id=${TELEGRAM_CHAT_ID}" \ + --data-urlencode "text=${PROJECT_NAME} Build Started 🚀 + 📁 Repository: ${GITHUB_REPOSITORY} + 👤 Initiator: ${GITHUB_ACTOR} + 🕒 Timestamp: ${COMMIT_TIMESTAMP} + 📝 Commit Message: ${COMMIT_MESSAGE}" - name: Checkout Code uses: actions/checkout@v4 - name: Notify Build Complete + env: + TELEGRAM_BOT_TOKEN: ${{ secrets.DEV_ACTIONS_BOT_TOKEN }} + TELEGRAM_CHAT_ID: ${{ secrets.DEV_ACTIONS_GROUP_ID }} + COMMIT_MESSAGE: ${{ github.event.head_commit.message }} + COMMIT_TIMESTAMP: ${{ github.event.head_commit.timestamp }} run: | - curl -s -X POST https://api.telegram.org/bot${{ secrets.DEV_ACTIONS_BOT_TOKEN }}/sendMessage \ - -d chat_id="${{ secrets.DEV_ACTIONS_GROUP_ID }}" \ - -d text=" - ${{ env.PROJECT_NAME }} Code Checked Out � - 📁 Repository: ${{ github.repository }} - 👤 Initiator: ${{ github.actor }} - 🕒 Timestamp: ${{ github.event.head_commit.timestamp }} - 📝 Commit Message: ${{ github.event.head_commit.message }}" + curl -s -X POST "https://api.telegram.org/bot${TELEGRAM_BOT_TOKEN}/sendMessage" \ + --data-urlencode "chat_id=${TELEGRAM_CHAT_ID}" \ + --data-urlencode "text=${PROJECT_NAME} Code Checked Out 📦 + 📁 Repository: ${GITHUB_REPOSITORY} + 👤 Initiator: ${GITHUB_ACTOR} + 🕒 Timestamp: ${COMMIT_TIMESTAMP} + 📝 Commit Message: ${COMMIT_MESSAGE}" # ✅ Check if .git directory exists remotely - name: Check if Git Exists on Server @@ -148,26 +156,34 @@ jobs: sudo systemctl status ${{ env.SERVICE_NAME }} --no-pager - name: Notify Deploy Complete + env: + TELEGRAM_BOT_TOKEN: ${{ secrets.DEV_ACTIONS_BOT_TOKEN }} + TELEGRAM_CHAT_ID: ${{ secrets.DEV_ACTIONS_GROUP_ID }} + COMMIT_MESSAGE: ${{ github.event.head_commit.message }} + COMMIT_TIMESTAMP: ${{ github.event.head_commit.timestamp }} run: | - curl -s -X POST https://api.telegram.org/bot${{ secrets.DEV_ACTIONS_BOT_TOKEN }}/sendMessage \ - -d chat_id="${{ secrets.DEV_ACTIONS_GROUP_ID }}" \ - -d text=" - ${{ env.PROJECT_NAME }} Deploy Complete ✅ - 📁 Repository: ${{ github.repository }} - 👤 Initiator: ${{ github.actor }} - 🕒 Timestamp: ${{ github.event.head_commit.timestamp }} - 📝 Commit Message: ${{ github.event.head_commit.message }}" + curl -s -X POST "https://api.telegram.org/bot${TELEGRAM_BOT_TOKEN}/sendMessage" \ + --data-urlencode "chat_id=${TELEGRAM_CHAT_ID}" \ + --data-urlencode "text=${PROJECT_NAME} Deploy Complete ✅ + 📁 Repository: ${GITHUB_REPOSITORY} + 👤 Initiator: ${GITHUB_ACTOR} + 🕒 Timestamp: ${COMMIT_TIMESTAMP} + 📝 Commit Message: ${COMMIT_MESSAGE}" - name: Notify Deploy Failure if: failure() + env: + TELEGRAM_BOT_TOKEN: ${{ secrets.DEV_ACTIONS_BOT_TOKEN }} + TELEGRAM_CHAT_ID: ${{ secrets.DEV_ACTIONS_GROUP_ID }} + COMMIT_MESSAGE: ${{ github.event.head_commit.message }} + COMMIT_TIMESTAMP: ${{ github.event.head_commit.timestamp }} run: | - curl -s -X POST https://api.telegram.org/bot${{ secrets.DEV_ACTIONS_BOT_TOKEN }}/sendMessage \ - -d chat_id="${{ secrets.DEV_ACTIONS_GROUP_ID }}" \ - -d text=" - ❌ ${{ env.PROJECT_NAME }} Deploy Failed! - 📁 Repository: ${{ github.repository }} - 👤 Initiator: ${{ github.actor }} - 🕒 Timestamp: ${{ github.event.head_commit.timestamp }} - 📝 Commit Message: ${{ github.event.head_commit.message }} - + curl -s -X POST "https://api.telegram.org/bot${TELEGRAM_BOT_TOKEN}/sendMessage" \ + --data-urlencode "chat_id=${TELEGRAM_CHAT_ID}" \ + --data-urlencode "text=❌ ${PROJECT_NAME} Deploy Failed! + 📁 Repository: ${GITHUB_REPOSITORY} + 👤 Initiator: ${GITHUB_ACTOR} + 🕒 Timestamp: ${COMMIT_TIMESTAMP} + 📝 Commit Message: ${COMMIT_MESSAGE} + Please check the GitHub Actions logs for more details."