docker-docs

mirror of https://github.com/docker/docs.git synced 2026-06-19 07:35:16 +00:00

Files

T

Lorena Rangel f90b2db317 Fix script injection in release notes PR trigger workflow (#24828 )

## Description

The `release-notes-pr-trigger` workflow was interpolating PR context
values
(`html_url`, `title`, `user.login`) directly into a shell heredoc. A
specially crafted PR title or author name could break out of the JSON
string
and execute arbitrary commands.

This change moves the GitHub context values into environment variables
and
uses `jq` to safely construct the JSON artifact, eliminating the
injection
vector.

## Related issues or tickets

None

## Reviews

- [x] Technical review

Signed-off-by: Lorena Rangel <lorena.rangel@docker.com>

2026-04-20 09:58:58 +01:00

agents

Clarify docs-scanner broken link rule to prevent 404s being filed as cross-reference issues

2026-04-08 15:36:42 +02:00

ISSUE_TEMPLATE

Desktop: update issue tracker links (#23976 )

2026-01-19 11:08:38 +00:00

prompts

AI: freshness (#23190 )

2025-08-05 13:38:35 +02:00

workflows

Fix script injection in release notes PR trigger workflow (#24828 )