chore: prevent action bash escapes

[rbtr]

Description

@robertprast in #285 and @random-dudde over at https://github.com/random-dudde/retina/pull/1 are poking at the commit-message Action trying to pull off a bash escape exploit.

The bash escape actually exists, due to the direct usage of the PR title:

commit_msg_header="${{ github.event.pull_request.title }}"

However, this is not readily exploitable because we require approval to run workflows on all external contributions. A maintainer would need to approve the workflow, which makes it unlikely that any useful bash could be sneakily stuffed in to the title and executed.

Even getting workflow approval with a benign title and then updating it later is correctly handled by GH and requires a new maintainer approval:

preventing a TOCTOU malicious title swap.

With that all said...unlikely does not mean impossible, and even though it is not a zero-click attack, xz showed us that social engineering can be extremely effective.

This change removes the bash escape by staging the user-input in an intermediate environment variable at the Job level.

Related Issue

If this pull request is related to any issue, please mention it here. Additionally, make sure that the issue is assigned to you before submitting this pull request.

Checklist

• I have read the contributing documentation.
• I signed and signed-off the commits (git commit -S -s ...). See this documentation on signing commits.
• I have correctly attributed the author(s) of the code.
• I have tested the changes locally.
• I have followed the project's style guidelines.
• I have updated the documentation, if necessary.
• I have added tests, if applicable.

Screenshots (if applicable) or Testing Completed

Please add any relevant screenshots or GIFs to showcase the changes made.

Additional Notes

Add any additional notes or context about the pull request here.

---

Please refer to the CONTRIBUTING.md file for more information on how to contribute to this project.

[huntergregory]

🛡️

[robertprast]

Hey all, y'all hopped on this one quite quickly and nailed the impact assessment. Historically Ive reported similar findings on other Microsoft repos to the MSRC and was going about to fill a new report for this repo after looking more into any impact escalations (though no other vectors are jumping out to me). Overall solid stuff! Happy to provide any info on my end too

[rbtr]

Thanks @robertprast, if you find anything else do let us know 🙂
MSRC reports are good and they will pass findings on to us pretty quickly. You can also report directly to immediately get our attention.

[random-dudde]

Thanks @robertprast, if you find anything else do let us know 🙂 MSRC reports are good and they will pass findings on to us pretty quickly. You can also report directly to immediately get our attention.

I am running poutine on public repos, and will let you know if there will be anything else.