Skip to content

Support spaces in file names #322

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
akohout-hai wants to merge 1 commit into
base: master
Choose a base branch
from
Open

Support spaces in file names #322

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
15 changes: 8 additions & 7 deletions entrypoint.sh
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -32,6 +32,7 @@ echo "----------------------------------------------------------------"
SINGLE="'"
DOUBLE='"'
SPLIT=false
SOURCES_LIST=()

if [ -n "$INPUT_SOURCE_FILES" ]; then

Expand Down Expand Up @@ -82,7 +83,7 @@ if [ -n "$INPUT_SOURCE_FILES" ]; then
continue
fi

SOURCES_LIST="$SOURCES_LIST --source $FILE"
SOURCES_LIST+=("--source" "$FILE")
echo "Checking quoted file >$FILE<"

done
Expand All @@ -102,12 +103,12 @@ if [ -n "$INPUT_SOURCE_FILES" ]; then
echo "Skipping file >$FILE<"
continue
fi
SOURCES_LIST="$SOURCES_LIST --source $FILE"
SOURCES_LIST+=("--source" "$FILE")
echo "Checking file >$FILE<"
done
fi

echo "Checking files specification in sources_list as: >$SOURCES_LIST<"
echo "Checking files specification in sources_list as: >${SOURCES_LIST[*]}<"

else
echo "Checking files matching specification outlined in: >$SPELLCHECK_CONFIG_FILE<"
Expand Down Expand Up @@ -153,14 +154,14 @@ EXITCODE=0
# pyspelling --verbose --config "$SPELLCHECK_CONFIG_FILE" --spellchecker "$SPELL_CHECKER" --name $TASK_NAME --source $SOURCES_LIST
# source and name are included in the parameters used

if [ -n "$INPUT_OUTPUT_FILE" ] && [ -n "$SOURCES_LIST" ]; then
$COMMAND --config "$SPELLCHECK_CONFIG_FILE" --spellchecker "$SPELL_CHECKER" $TASK_NAME $SOURCES_LIST | tee "$INPUT_OUTPUT_FILE"
if [ -n "$INPUT_OUTPUT_FILE" ] && [ "${#SOURCES_LIST[@]}" -gt 0 ]; then
$COMMAND --config "$SPELLCHECK_CONFIG_FILE" --spellchecker "$SPELL_CHECKER" $TASK_NAME "${SOURCES_LIST[@]}" | tee "$INPUT_OUTPUT_FILE"
Copy link

Copilot AI Feb 23, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Variable TASK_NAME is derived directly from the untrusted action input INPUT_TASK_NAME and then expanded unquoted in the shell command at this line. If a workflow passes attacker-controlled data into task_name (for example using PR titles or other user input), shell metacharacters like $(...) or backticks in the value will be interpreted by the shell, allowing arbitrary commands to execute in the GitHub Actions runner. To prevent command injection, avoid interpolating untrusted input into a shell command string and instead pass it as a separately quoted argument (for example by building an argument list such as TASK_NAME_ARGS=(--name "$INPUT_TASK_NAME") and expanding it as "${TASK_NAME_ARGS[@]}").

Copilot uses AI. Check for mistakes.
Copy link
Collaborator

@jonasbn jonasbn Feb 24, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

@akohout-hai what do you think about the suggestion from copilot, it follows your implementation pattern, so it would be okay IMHO. And I believe it is necessary to address the unsafe TASK_NAME

EXITCODE=${PIPESTATUS[0]}
elif [ -n "$INPUT_OUTPUT_FILE" ]; then
$COMMAND --config "$SPELLCHECK_CONFIG_FILE" --spellchecker "$SPELL_CHECKER" $TASK_NAME | tee "$INPUT_OUTPUT_FILE"
EXITCODE=${PIPESTATUS[0]}
elif [ -n "$SOURCES_LIST" ]; then
$COMMAND --config "$SPELLCHECK_CONFIG_FILE" --spellchecker "$SPELL_CHECKER" $TASK_NAME $SOURCES_LIST
elif [ "${#SOURCES_LIST[@]}" -gt 0 ]; then
$COMMAND --config "$SPELLCHECK_CONFIG_FILE" --spellchecker "$SPELL_CHECKER" $TASK_NAME "${SOURCES_LIST[@]}"
EXITCODE=$?
elif [ -z "$INPUT_SOURCE_FILES" ]; then
$COMMAND --config "$SPELLCHECK_CONFIG_FILE" --spellchecker "$SPELL_CHECKER" $TASK_NAME
Expand Down