4 ms·

Github should not disallow/filter branch names. Developers should write (and be be given the tools to) workflows that do not allow command injection.

• staunton 2y ago
  GitHub could disallow/filter branch names. Developers will not write (and be be given the tools to) workflows that do not allow command injection.
  • SahAssar 2y ago
    Do you have the same reasoning for SQL/XXS injection? Should developers not write code that is resistant to SQL/XXS injection and instead rely on something like a WAF? These protections (WAF for SQL/XSS, branch names for this) will never be enough. The code/logic must be secure, any additional layer is not enough since the actual target must be secured. Developers will do it if its necessary, and it is. These situations are just proving it is necessary.
  • blibble 2y ago
    the garbage that is yaml "builds" is essentially impossible to secure untyped strings, untyped strings everywhere and they're directly executed, with untrusted user input templated in, with full release privileges the entire thing is insane to think pypa deprecated pgp offline signing for this...
• geraldcombs 2y ago
  Why not both? Git itself checks and sanitizes branch names, and GitHub should arguably match that behavior. I don't think anyone would object to safer workflows and related tooling instead of being told "here, have some bash inside YAML, now be careful!"
  • SahAssar 2y ago
    Of course I agree that github should follow the git spec for branch names. I meant that I don't think github should impose any additional restrictions on branch names.