Skip to content

Conversation

@adrikim-mp
Copy link
Contributor

Summary

  • Removes the PR title from being echoed to output. A PR title, being user-controlled, can technically be set to something malicious (eg. ; echo $GITHUB_TOKEN_OF_CHOICE) since it's not escaped. However, since we already have robust controls around untrusted PR environments, removing this is more of a defense-in-depth measure.

Testing Plan

  • No tests needed, just a text change.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant