Handle weird input paths

[kylewlacy]

I saw a recent blog post by Joren Vrancken about a command injection vulnerability in the GH Pages build pipeline. A small code snippet from this repo was shared, which showed how the input path provided to this action was not being escaped. This action could be triggered by an HTTP endpoint used when changing Jekyll themes, which is ultimately what led to the vulnerability.

The vulnerability has since been resolved by disabling the Jekyll theme picker in the UI (and the associated HTTP endpoint), but the underlying bug in this action still exists: paths are still interpolated directly in a shell script instead of being quoted or escaped properly. Practically speaking, this means that this action doesn't allow input paths with spaces or quotes.

This PR fixes that bug by passing the input paths as an env var, rather than interpolating the string in the shell script directly. I even set up some test repositories to exercise this, so now even repo layouts with weird path names work, including spaces and double quotes.

[JamesMGreene]

We appreciate you bringing this to our attention. It's always good to close these gaps!

[JamesMGreene]

This fix is now available in the following versions, ordered from most specific/secure to least:

uses: actions/upload-pages-artifact@a597aecd27af1cf14095ccaa29169358e3d91e28
uses: actions/[email protected]
uses: actions/upload-pages-artifact@v1
uses: actions/upload-pages-artifact@main

🚀