Skip to content
Open
Show file tree
Hide file tree
Changes from all commits
Commits
File filter

Filter by extension

Filter by extension


Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
94 changes: 94 additions & 0 deletions .github/workflows/config.yaml
Original file line number Diff line number Diff line change
@@ -0,0 +1,94 @@
name: CI
on:
push:
branches:
- development
- qa
- staging
- production
- labs
pull_request:
branches:
- "*"

jobs:
rules:
name: Rules
runs-on: ubuntu-latest
outputs:
branch_name: ${{ steps.validations.outputs.branch_name }}
should_deploy: ${{ steps.validations.outputs.should_deploy}}
steps:
- name: Fetch Branch Name
uses: aptyInc/gha-branch-name@master
id: validations

lint:
name: LINT_TEST
needs: [rules]
runs-on: ubuntu-latest
steps:
- name: Checkout Code
uses: actions/checkout@v2

- name: Caching node modules
id: modules-cache
uses: actions/cache@v2
with:
path: "node_modules"
key: node-modules-${{ hashFiles('package.json') }}

- name: Install node modules
if: steps.modules-cache.outputs.cache-hit != 'true'
run: npm install

deploy:
needs: [rules, lint]
name: Deploy
runs-on: ubuntu-latest
if: ${{ needs.rules.outputs.should_deploy == 'true' }}
steps:
- uses: actions/checkout@master
- uses: actions/setup-node@v1

- uses: webfactory/ssh-agent@v0.4.1
with:
ssh-private-key: ${{ secrets.SSH_KEY }}

- name: Caching node modules
id: modules-cache
uses: actions/cache@v2
with:
path: "node_modules"
key: node-modules-${{ hashFiles('package.json') }}

- name: Install node modules
if: steps.modules-cache.outputs.cache-hit != 'true'
run: npm install

- name: Building code
run: npm run build && cp package.json build/package.json

- name: Commit code for tinymce-react
run: |
cp package.json ./build
cd build
git init
git config user.email "admin@apty.io"
git config user.name "git-ci"
git add .
git commit -m "${{needs.rules.outputs.branch_name}}-${{github.event.head_commit.message}}" -a
git remote add origin "git@github.com:aptyInc/tinymce-react.git"
git checkout -b "${{needs.rules.outputs.branch_name}}-${{ github.sha }}"
git push origin "${{needs.rules.outputs.branch_name}}-${{ github.sha }}"
Comment on lines +73 to +83

Check failure

Code scanning / CodeQL

Expression injection in Actions Critical

Potential injection from the ${{ github.event.head_commit.message }}, which may be controlled by an external user.

Copilot Autofix

AI about 1 year ago

To fix the problem, we need to avoid using user-controlled input directly in the run command. Instead, we should set the untrusted input value to an intermediate environment variable and then use the environment variable using the native shell syntax. This will prevent any potential code injection.

Specifically, we will:

  1. Set the branch_name and commit_message to environment variables.
  2. Use these environment variables in the run command using shell syntax.
Suggested changeset 1
.github/workflows/config.yaml

Autofix patch

Autofix patch
Run the following command in your local git repository to apply this patch
cat << 'EOF' | git apply
diff --git a/.github/workflows/config.yaml b/.github/workflows/config.yaml
--- a/.github/workflows/config.yaml
+++ b/.github/workflows/config.yaml
@@ -72,2 +72,6 @@
       - name: Commit code for tinymce-react
+        env:
+          BRANCH_NAME: ${{ needs.rules.outputs.branch_name }}
+          COMMIT_MESSAGE: ${{ github.event.head_commit.message }}
+          GITHUB_SHA: ${{ github.sha }}
         run: |
@@ -79,6 +83,6 @@
           git add .
-          git commit -m "${{needs.rules.outputs.branch_name}}-${{github.event.head_commit.message}}" -a
+          git commit -m "${BRANCH_NAME}-${COMMIT_MESSAGE}" -a
           git remote add origin "git@github.com:aptyInc/tinymce-react.git"
-          git checkout -b "${{needs.rules.outputs.branch_name}}-${{ github.sha }}"
-          git push origin "${{needs.rules.outputs.branch_name}}-${{ github.sha }}"
+          git checkout -b "${BRANCH_NAME}-${GITHUB_SHA}"
+          git push origin "${BRANCH_NAME}-${GITHUB_SHA}"
   notifications:
EOF
@@ -72,2 +72,6 @@
- name: Commit code for tinymce-react
env:
BRANCH_NAME: ${{ needs.rules.outputs.branch_name }}
COMMIT_MESSAGE: ${{ github.event.head_commit.message }}
GITHUB_SHA: ${{ github.sha }}
run: |
@@ -79,6 +83,6 @@
git add .
git commit -m "${{needs.rules.outputs.branch_name}}-${{github.event.head_commit.message}}" -a
git commit -m "${BRANCH_NAME}-${COMMIT_MESSAGE}" -a
git remote add origin "git@github.com:aptyInc/tinymce-react.git"
git checkout -b "${{needs.rules.outputs.branch_name}}-${{ github.sha }}"
git push origin "${{needs.rules.outputs.branch_name}}-${{ github.sha }}"
git checkout -b "${BRANCH_NAME}-${GITHUB_SHA}"
git push origin "${BRANCH_NAME}-${GITHUB_SHA}"
notifications:
Copilot is powered by AI and may make mistakes. Always verify output.
notifications:
name: Notification
runs-on: ubuntu-latest
needs: [rules, deploy]
steps:
- uses: actions/checkout@master
- name: Getting user profile url
id: user_profile
uses: saiumesh535/gh-avatar-url@main
with:
username: ${{github.actor}}
4 changes: 2 additions & 2 deletions package.json
Original file line number Diff line number Diff line change
@@ -1,7 +1,7 @@
{
"description": "Official TinyMCE React Component",
"description": "Apty TinyMCE React component",
"repository": {
"url": "https://github.com/tinymce/tinymce-react"
"url": "https://github.com/aptyInc/tinymce-react"
},
"files": [
"lib",
Expand Down
5 changes: 0 additions & 5 deletions src/main/ts/components/Editor.tsx
Original file line number Diff line number Diff line change
Expand Up @@ -309,11 +309,6 @@ export class Editor extends React.Component<IAllProps> {
}
});
}
// fallback to the cloud when the tinymceScriptSrc is not specified
const channel = this.props.cloudChannel as Version; // `cloudChannel` is in `defaultProps`, so it's always defined.
const apiKey = this.props.apiKey ? this.props.apiKey : 'no-api-key';
const cloudTinyJs = `https://cdn.tiny.cloud/1/${apiKey}/tinymce/${channel}/tinymce.min.js`;
return [{ src: cloudTinyJs, async, defer }];
}

private getInitialValue() {
Expand Down
34 changes: 0 additions & 34 deletions src/test/ts/browser/LoadTinyTest.ts
Original file line number Diff line number Diff line change
Expand Up @@ -39,38 +39,4 @@ describe('LoadTinyTest', () => {
assertTinymceVersion(version);
});
});

CLOUD_VERSIONS.forEach((version) => {
it(`Should be able to load TinyMCE from Cloud (${version})`, async () => {
const apiKey = 'a-fake-api-key';
using _ = await render({ apiKey, cloudChannel: version });
assertTinymceVersion(version);
Assertions.assertEq(
'TinyMCE should have been loaded from Cloud',
`https://cdn.tiny.cloud/1/${apiKey}/tinymce/${version}`,
Global.tinymce.baseURI.source
);
});

it(`Should be able to load TinyMCE (${version}) in hybrid`, async () => {
using _ = await render({
tinymceScriptSrc: [
`/project/node_modules/tinymce-${version}/tinymce.min.js`,
`https://cdn.tiny.cloud/1/${VALID_API_KEY}/tinymce/${version}/cloud-plugins.min.js?tinydrive=${version}`
],
plugins: [ 'tinydrive' ]
});
assertTinymceVersion(version);
Assertions.assertEq(
'TinyMCE should have been loaded locally',
`/project/node_modules/tinymce-${version}`,
Global.tinymce.baseURI.path
);
Assertions.assertEq(
'The tinydrive plugin should have defaults for the cloud',
`https://cdn.tiny.cloud/1/${VALID_API_KEY}/tinymce-plugins/tinydrive/${version}/plugin.min.js`,
(Global.tinymce.defaultOptions || Global.tinymce.defaultSettings)?.custom_plugin_urls?.tinydrive
);
});
});
});
Loading