Support disable/enable commands

[dcsobral]

The example from github blog is:

        # disable command workflow processing
        echo "::stop-commands::`echo -n ${{ github.token }} | sha256sum | head -c 64`"

        # log untrusted output
        echo "untrusted output"

        # enable workflow command processing
        echo "::`echo -n ${{ github.token }} | sha256sum | head -c 64`::"

The disable/enable is constant, so they could be provided as actions. Better yet, though, would be a withUntrusted or withCommandsDisabled workflow step that takes other workflow steps as input, and runs then with commands disabled as above.

[djspiewak]

I haven't looked too closely at stop-commands; what's the use-case for this beyond demonstrating security vulnerabilities?

[dcsobral]

It disables all command processing when echoing unsanitized strings to stdout.

…

-- Daniel C. Sobral

On Mon, Nov 16, 2020 at 3:08 PM Daniel Spiewak ***@***.***> wrote: I haven't looked too closely at stop-commands; what's the use-case for this beyond demonstrating security vulnerabilities? — You are receiving this because you authored the thread. Reply to this email directly, view it on GitHub <#36 (comment)>, or unsubscribe <https://github.com/notifications/unsubscribe-auth/AABCOF33QMUCED5NBYV4G2TSQGPFDANCNFSM4TXWLBKQ> .

[djspiewak]

Is that common enough to merit having its own semantic action rather than just using WorkflowStep.Run(List("echo ::stop-commands::"))?

[dcsobral]

It's not just stop-commands -- you have to add the token as well, with all that decoding. I believe the secure way of doing things should be as easy as possible, that's my main concern.

…

-- Daniel C. Sobral

On Mon, Nov 16, 2020 at 3:20 PM Daniel Spiewak ***@***.***> wrote: Is that common enough to merit having its own semantic action rather than just using WorkflowStep.Run(List("echo ::stop-commands::"))? — You are receiving this because you authored the thread. Reply to this email directly, view it on GitHub <#36 (comment)>, or unsubscribe <https://github.com/notifications/unsubscribe-auth/AABCOFZZDLKQP3RVETTDWMLSQGQRPANCNFSM4TXWLBKQ> .

[djspiewak]

Ahhhh, I see. I would accept a PR for that. Probably something like commandsDisabled(List[WorkflowStep]): List[WorkflowStep] combinator as you suggested.