fix: reject env values with line breaks in config templates - #154
Open
Hermsi1337 wants to merge 1 commit into
Open
fix: reject env values with line breaks in config templates#154Hermsi1337 wants to merge 1 commit into
Hermsi1337 wants to merge 1 commit into
Conversation
Values substituted via {{ .Env.NAME }} were spliced into the YAML
verbatim. A value containing a line break escaped its position and was
parsed as new top-level YAML, silently corrupting the stack definition;
quoted multi-line secrets were silently folded into a single line.
A probe render now substitutes every line-break-carrying value with a
nonce token first. Only values that actually reach the rendered output
are rejected, with an error naming the variable, so unreferenced
multi-line variables (common on GitHub runners) keep working.
Closes #153
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Fixes #153.
Values substituted via
{{ .Env.NAME }}were spliced into the YAML verbatim bytext/template. A value containing\nor\r:UpdateStackthen applies as full state (quoting does not protect; a"+ newline in the value breaks out of quoted scalars too),Changes
cmd/action/main.go:renderConfigTemplate()now performs a probe render first, in which every env value containing a line break is replaced by a nonce-derived token. If a token appears in the output, that variable actually reached the YAML and rendering fails with an error naming it:Otherwise the template is rendered with the real values as before. Properties:
{{ .Env.NAME }}syntax and semantics unchanged for single-line values (.Envstays a plainmap[string]string).{{ index .Env "X" }}and{{ range .Env }}, which map-skipping or parse-tree-walking approaches miss silently.{{ if }}branches keep working.cmd/action/main_test.go: table-driven reject tests (value position, comment position, quoted breakout, CRLF, lone CR, trailing CR, quoted PEM,index) plus three false-positive guards. Existing tests untouched.README.md:> [!IMPORTANT]note that{{ .Env.NAME }}values must be single-line.Testing
go test -count=1 ./...: all pass (22 top-level tests, 8 new subtests) ingolang:1.24.go vet ./...and gofmt: clean.golangci-lint(the Makefile'squay.io/mittwald/golangci-lint:0.0.38image with the repo config): no findings.Behavior change
Workflows that today reference a multi-line secret from a quoted position "succeed" while silently deploying a folded, broken value. They will now fail loudly with the error above — this is the intended fix, but worth calling out in the release notes.
Related: #151 / #152 (template rendering vs. YAML comments — independent, composes cleanly with this change).
🤖 Generated with Claude Code