Skip to content

fix(ci): prevent shell injection via CI event data in gitCommitInfoPlugin #40684

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
pavelfeldman merged 1 commit into from
May 7, 2026
Merged

fix(ci): prevent shell injection via CI event data in gitCommitInfoPlugin #40684

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
30 changes: 15 additions & 15 deletions packages/playwright/src/plugins/gitCommitInfoPlugin.ts
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -124,12 +124,12 @@ async function gitCommitInfo(gitDir: string): Promise<GitCommitInfo | undefined>
'%cn', // committer name
'%ce', // committer email
'%ct', // committer date, UNIX timestamp
'', // branch
];
const output = await runGit(`git log -1 --pretty=format:"${tokens.join(separator)}" && git rev-parse --abbrev-ref HEAD`, gitDir);
if (!output)
const logOutput = await runGit(['log', '-1', `--pretty=format:${tokens.join(separator)}`], gitDir);
if (!logOutput)
return undefined;
const [hash, shortHash, subject, body, authorName, authorEmail, authorTime, committerName, committerEmail, committerTime, branch] = output.split(separator);
const branchOutput = await runGit(['rev-parse', '--abbrev-ref', 'HEAD'], gitDir);
const [hash, shortHash, subject, body, authorName, authorEmail, authorTime, committerName, committerEmail, committerTime] = logOutput.split(separator);

return {
shortHash,
Expand All @@ -146,16 +146,16 @@ async function gitCommitInfo(gitDir: string): Promise<GitCommitInfo | undefined>
email: committerEmail,
time: +committerTime * 1000,
},
branch: branch.trim(),
branch: branchOutput?.trim() ?? '',
};
}

async function gitDiff(gitDir: string, ci?: CIInfo): Promise<string | undefined> {
const diffLimit = 100_000;
if (ci?.prBaseHash) {
// https://git-scm.com/docs/git-fetch
await runGit(`git fetch origin ${ci.prBaseHash} --depth=1 --no-auto-maintenance --no-auto-gc --no-tags --no-recurse-submodules`, gitDir);
const diff = await runGit(`git diff ${ci.prBaseHash} HEAD`, gitDir);
await runGit(['fetch', 'origin', ci.prBaseHash, '--depth=1', '--no-auto-maintenance', '--no-auto-gc', '--no-tags', '--no-recurse-submodules'], gitDir);
const diff = await runGit(['diff', ci.prBaseHash, 'HEAD'], gitDir);
if (diff)
return diff.substring(0, diffLimit);
}
Expand All @@ -165,7 +165,7 @@ async function gitDiff(gitDir: string, ci?: CIInfo): Promise<string | undefined>
return;

// Check dirty state first.
const uncommitted = await runGit('git diff', gitDir);
const uncommitted = await runGit(['diff'], gitDir);
if (uncommitted === undefined) {
// Failed to run git diff.
return;
Expand All @@ -174,20 +174,20 @@ async function gitDiff(gitDir: string, ci?: CIInfo): Promise<string | undefined>
return uncommitted.substring(0, diffLimit);

// Assume non-shallow checkout on local.
const diff = await runGit('git diff HEAD~1', gitDir);
const diff = await runGit(['diff', 'HEAD~1'], gitDir);
return diff?.substring(0, diffLimit);
}

async function runGit(command: string, cwd: string): Promise<string | undefined> {
debug(`running "${command}"`);
async function runGit(args: string[], cwd: string): Promise<string | undefined> {
debug(`running "git ${args.join(' ')}"`);
const start = monotonicTime();
const result = await spawnAsync(
command,
[],
{ stdio: 'pipe', cwd, timeout: GIT_OPERATIONS_TIMEOUT_MS, shell: true }
'git',
args,
{ stdio: 'pipe', cwd, timeout: GIT_OPERATIONS_TIMEOUT_MS }
);
if (monotonicTime() - start > GIT_OPERATIONS_TIMEOUT_MS) {
print(`timeout of ${GIT_OPERATIONS_TIMEOUT_MS}ms exceeded while running "${command}"`);
print(`timeout of ${GIT_OPERATIONS_TIMEOUT_MS}ms exceeded while running "git ${args.join(' ')}"`);
return;
}
if (result.code)
Expand Down
Loading