diff --git a/.github/workflows/X-x86_64_X.yml b/.github/workflows/X-x86_64_X.yml index 2bab4cd..9bb1faa 100644 --- a/.github/workflows/X-x86_64_X.yml +++ b/.github/workflows/X-x86_64_X.yml @@ -124,11 +124,19 @@ jobs: run: | echo "Free space:" df -h - if [ -n "${{ github.event.inputs.Tempoary_CONFIG }}" ] + INPUT_CONFIG="${{ github.event.inputs.Tempoary_CONFIG || '' }}" + INPUT_IP="${{ github.event.inputs.Tempoary_IP || '' }}" + INPUT_FLAG="${{ github.event.inputs.Tempoary_FLAG || '' }}" + + if [ -n "${INPUT_CONFIG}" ] then - if [ -f "$GITHUB_WORKSPACE/Configs/${{ github.event.inputs.Tempoary_CONFIG }}" ] + if [[ ! "${INPUT_CONFIG}" =~ ^[A-Za-z0-9._-]+$ ]] then - CONFIG_FILE=${{ github.event.inputs.Tempoary_CONFIG }} + echo "Invalid CONFIG_FILE input: [${INPUT_CONFIG}]" + exit 1 + elif [ -f "$GITHUB_WORKSPACE/Configs/${INPUT_CONFIG}" ] + then + CONFIG_FILE="${INPUT_CONFIG}" else CONFIG_FILE=${{ env.CONFIG_FILE }} fi @@ -143,15 +151,34 @@ jobs: echo "CONFIG_FILE: [/Config/$CONFIG_FILE]" echo "CONFIG_FILE=$CONFIG_FILE" >> $GITHUB_ENV fi - if [ -n "${{ github.event.inputs.Tempoary_IP }}" ] + if [ -n "${INPUT_IP}" ] then - echo "IP: [${{ github.event.inputs.Tempoary_IP }}]" - echo "Tempoary_IP=${{ github.event.inputs.Tempoary_IP }}" >> $GITHUB_ENV + if [[ ! "${INPUT_IP}" =~ ^([0-9]{1,3}\.){3}[0-9]{1,3}$ ]] + then + echo "Invalid Tempoary_IP input: [${INPUT_IP}]" + exit 1 + fi + IFS=. read -r ip1 ip2 ip3 ip4 <<< "${INPUT_IP}" + for octet in "$ip1" "$ip2" "$ip3" "$ip4" + do + if (( octet < 0 || octet > 255 )) + then + echo "Invalid Tempoary_IP input: [${INPUT_IP}]" + exit 1 + fi + done + echo "IP: [${INPUT_IP}]" + echo "Tempoary_IP=${INPUT_IP}" >> $GITHUB_ENV fi - if [ -n "${{ github.event.inputs.Tempoary_FLAG }}" ] + if [ -n "${INPUT_FLAG}" ] then - echo "FLAG: [${{ github.event.inputs.Tempoary_FLAG }}]" - echo "Tempoary_FLAG=${{ github.event.inputs.Tempoary_FLAG }}" >> $GITHUB_ENV + if [[ ! "${INPUT_FLAG}" =~ ^[A-Za-z0-9]+$ ]] + then + echo "Invalid Tempoary_FLAG input: [${INPUT_FLAG}]" + exit 1 + fi + echo "FLAG: [${INPUT_FLAG}]" + echo "Tempoary_FLAG=${INPUT_FLAG}" >> $GITHUB_ENV fi REPO_URL="https://github.com/$(cut -d \: -f 1 <<< ${{ env.DEFAULT_SOURCE }})" REPO_BRANCH=$(cut -d \: -f 2 <<< ${{ env.DEFAULT_SOURCE }}) diff --git a/.github/workflows/X-x86_64_Y.yml b/.github/workflows/X-x86_64_Y.yml index fd25022..879a002 100644 --- a/.github/workflows/X-x86_64_Y.yml +++ b/.github/workflows/X-x86_64_Y.yml @@ -115,11 +115,19 @@ jobs: run: | echo "Free space:" df -h - if [ -n "${{ github.event.inputs.Tempoary_CONFIG }}" ] + INPUT_CONFIG="${{ github.event.inputs.Tempoary_CONFIG || '' }}" + INPUT_IP="${{ github.event.inputs.Tempoary_IP || '' }}" + INPUT_FLAG="${{ github.event.inputs.Tempoary_FLAG || '' }}" + + if [ -n "${INPUT_CONFIG}" ] then - if [ -f "$GITHUB_WORKSPACE/Configs/${{ github.event.inputs.Tempoary_CONFIG }}" ] + if [[ ! "${INPUT_CONFIG}" =~ ^[A-Za-z0-9._-]+$ ]] then - CONFIG_FILE=${{ github.event.inputs.Tempoary_CONFIG }} + echo "Invalid CONFIG_FILE input: [${INPUT_CONFIG}]" + exit 1 + elif [ -f "$GITHUB_WORKSPACE/Configs/${INPUT_CONFIG}" ] + then + CONFIG_FILE="${INPUT_CONFIG}" else CONFIG_FILE=${{ env.CONFIG_FILE }} fi @@ -134,15 +142,34 @@ jobs: echo "CONFIG_FILE: [/Config/$CONFIG_FILE]" echo "CONFIG_FILE=$CONFIG_FILE" >> $GITHUB_ENV fi - if [ -n "${{ github.event.inputs.Tempoary_IP }}" ] + if [ -n "${INPUT_IP}" ] then - echo "IP: [${{ github.event.inputs.Tempoary_IP }}]" - echo "Tempoary_IP=${{ github.event.inputs.Tempoary_IP }}" >> $GITHUB_ENV + if [[ ! "${INPUT_IP}" =~ ^([0-9]{1,3}\.){3}[0-9]{1,3}$ ]] + then + echo "Invalid Tempoary_IP input: [${INPUT_IP}]" + exit 1 + fi + IFS=. read -r ip1 ip2 ip3 ip4 <<< "${INPUT_IP}" + for octet in "$ip1" "$ip2" "$ip3" "$ip4" + do + if (( octet < 0 || octet > 255 )) + then + echo "Invalid Tempoary_IP input: [${INPUT_IP}]" + exit 1 + fi + done + echo "IP: [${INPUT_IP}]" + echo "Tempoary_IP=${INPUT_IP}" >> $GITHUB_ENV fi - if [ -n "${{ github.event.inputs.Tempoary_FLAG }}" ] + if [ -n "${INPUT_FLAG}" ] then - echo "FLAG: [${{ github.event.inputs.Tempoary_FLAG }}]" - echo "Tempoary_FLAG=${{ github.event.inputs.Tempoary_FLAG }}" >> $GITHUB_ENV + if [[ ! "${INPUT_FLAG}" =~ ^[A-Za-z0-9]+$ ]] + then + echo "Invalid Tempoary_FLAG input: [${INPUT_FLAG}]" + exit 1 + fi + echo "FLAG: [${INPUT_FLAG}]" + echo "Tempoary_FLAG=${INPUT_FLAG}" >> $GITHUB_ENV fi REPO_URL="https://github.com/$(cut -d \: -f 1 <<< ${{ env.DEFAULT_SOURCE }})" REPO_BRANCH=$(cut -d \: -f 2 <<< ${{ env.DEFAULT_SOURCE }}) diff --git a/.github/workflows/X-x86_64_Z.yml b/.github/workflows/X-x86_64_Z.yml index 3368624..7ed622c 100644 --- a/.github/workflows/X-x86_64_Z.yml +++ b/.github/workflows/X-x86_64_Z.yml @@ -113,11 +113,19 @@ jobs: run: | echo "Free space:" df -h - if [ -n "${{ github.event.inputs.Tempoary_CONFIG }}" ] + INPUT_CONFIG="${{ github.event.inputs.Tempoary_CONFIG || '' }}" + INPUT_IP="${{ github.event.inputs.Tempoary_IP || '' }}" + INPUT_FLAG="${{ github.event.inputs.Tempoary_FLAG || '' }}" + + if [ -n "${INPUT_CONFIG}" ] then - if [ -f "$GITHUB_WORKSPACE/Configs/${{ github.event.inputs.Tempoary_CONFIG }}" ] + if [[ ! "${INPUT_CONFIG}" =~ ^[A-Za-z0-9._-]+$ ]] then - CONFIG_FILE=${{ github.event.inputs.Tempoary_CONFIG }} + echo "Invalid CONFIG_FILE input: [${INPUT_CONFIG}]" + exit 1 + elif [ -f "$GITHUB_WORKSPACE/Configs/${INPUT_CONFIG}" ] + then + CONFIG_FILE="${INPUT_CONFIG}" else CONFIG_FILE=${{ env.CONFIG_FILE }} fi @@ -132,15 +140,34 @@ jobs: echo "CONFIG_FILE: [/Config/$CONFIG_FILE]" echo "CONFIG_FILE=$CONFIG_FILE" >> $GITHUB_ENV fi - if [ -n "${{ github.event.inputs.Tempoary_IP }}" ] + if [ -n "${INPUT_IP}" ] then - echo "IP: [${{ github.event.inputs.Tempoary_IP }}]" - echo "Tempoary_IP=${{ github.event.inputs.Tempoary_IP }}" >> $GITHUB_ENV + if [[ ! "${INPUT_IP}" =~ ^([0-9]{1,3}\.){3}[0-9]{1,3}$ ]] + then + echo "Invalid Tempoary_IP input: [${INPUT_IP}]" + exit 1 + fi + IFS=. read -r ip1 ip2 ip3 ip4 <<< "${INPUT_IP}" + for octet in "$ip1" "$ip2" "$ip3" "$ip4" + do + if (( octet < 0 || octet > 255 )) + then + echo "Invalid Tempoary_IP input: [${INPUT_IP}]" + exit 1 + fi + done + echo "IP: [${INPUT_IP}]" + echo "Tempoary_IP=${INPUT_IP}" >> $GITHUB_ENV fi - if [ -n "${{ github.event.inputs.Tempoary_FLAG }}" ] + if [ -n "${INPUT_FLAG}" ] then - echo "FLAG: [${{ github.event.inputs.Tempoary_FLAG }}]" - echo "Tempoary_FLAG=${{ github.event.inputs.Tempoary_FLAG }}" >> $GITHUB_ENV + if [[ ! "${INPUT_FLAG}" =~ ^[A-Za-z0-9]+$ ]] + then + echo "Invalid Tempoary_FLAG input: [${INPUT_FLAG}]" + exit 1 + fi + echo "FLAG: [${INPUT_FLAG}]" + echo "Tempoary_FLAG=${INPUT_FLAG}" >> $GITHUB_ENV fi REPO_URL="https://github.com/$(cut -d \: -f 1 <<< ${{ env.DEFAULT_SOURCE }})" REPO_BRANCH=$(cut -d \: -f 2 <<< ${{ env.DEFAULT_SOURCE }}) diff --git a/AI_CHANGELOG_WORKFLOW_INPUT_VALIDATION.md b/AI_CHANGELOG_WORKFLOW_INPUT_VALIDATION.md new file mode 100644 index 0000000..42a8e4b --- /dev/null +++ b/AI_CHANGELOG_WORKFLOW_INPUT_VALIDATION.md @@ -0,0 +1,13 @@ +# AI Modification Log: Workflow Input Validation + +Date: 2026-06-29 + +## Change + +- Updated X/Y/Z `Load Custom Variables` steps to copy dispatch inputs into shell variables before use. +- Added validation for `Tempoary_CONFIG` file names, IPv4 `Tempoary_IP`, and alphanumeric `Tempoary_FLAG`. +- Kept the existing fallback to default `CONFIG_FILE` when a valid config-shaped input does not match a file in `Configs/`. + +## Reason + +Dispatch inputs were interpolated directly into shell commands. Validating and quoting them reduces accidental shell breakage and rejects unsafe config names, invalid IPs, and unsupported flag characters.